Commissioned by Kiteworks
Give an agent only the data its approved task requires. Decide whether it may read, download, change or share that data, since those are different permissions. Check requests against the task and current context, and set access to expire when it is no longer needed. Review those permissions before connecting the agent.
Define the permitted sources and operations before granting access. Broad repository access or a broad role can exceed a task’s needs. Kiteworks recommends combining role limits with checks on the agent, data, operation and workflow context. Its Data Policy Engine is described as evaluating the data, actor and requested action.
Kiteworks’s Data Control Plane page describes expiry controls for accounts, folders, files and shared links. Check how those settings connect to the end of your workflow; they do not establish automatic task-completion revocation across every integration. Exercise both an allowed operation and one outside the approved scope, then inspect the decisions. Check other access paths separately.
Put this into practice
- List required data and permitted operations before connecting the agent.
- Test allowed and out-of-scope requests through each access path.
- Confirm expiry and revocation behavior for your integration.
