Agent access rulebook — what to check before an AI agent touches client data

Who this is for and how to use it

This is the check you run before an AI agent gets access to a folder, an inbox, a database or a drive, not the explanation you write afterwards. It is written for an owner, office manager or operations lead at a 2 to 50 person firm who is about to hand a tool like Claude Code, Codex, Gemini CLI, Grok, Copilot or a self-hosted agent the keys to something that matters: tax returns, patient records, payroll, client contracts, the company's own playbooks.

Use it in three ways:

• Before a deployment: classify the data (section 3), read the one regime that applies to it (section 4), check the vendor row (section 5), and run the checklist (section 8). Twenty minutes.
• As the rule book: section 7 is a numbered list you can paste into an SOP, a contractor agreement or an employee handbook as-is.
• When something has gone wrong: section 9 is the clock. Start there.

It is not legal advice. It tells you which law is in play, what it generally requires and what a violation costs, so your conversation with a lawyer, a CPA or an insurer starts in the right place. Where a rule turns on your specific facts, the text says so.

The guide is maintained as a living document; the review date is in the byline, and section 10 says what gets re-checked and when.

We keep a private annex that maps these rules to our own setup. It is not published.

The core rule in one page

An agent is a new employee with perfect recall, no judgement about what it should not read, and a direct line to a third party. Treat it exactly as you would treat a temp from an agency who arrives on day one asking for the server password: give access by data class, never by convenience.

Four questions settle almost every case:

1. What class is the data? Public, internal, confidential or regulated. If any file in the folder is regulated, the folder is regulated.
2. Where does the agent send it? Every cloud agent transmits what it reads to the vendor's servers. The vendor's tier decides whether that copy is trained on, how long it is kept, and whether a contract (BAA, DPA) stands behind the promises. A self-hosted agent still calls a model somewhere; follow the API key.
3. What can the agent do, not just see? Reading a file is one risk. An agent with a shell, an email send, a payment tool or write access to the drive can be turned against you by text it reads (prompt injection). Capability, not intent, sets the blast radius.
4. Who signed off, and is it written down? Regulated data needs a named person, a dated record of what was granted, and a contract with the vendor. Without the record, every breach is unreported and every audit is failed.

The matching rule, which the rest of this document explains:

"Yes" in this table means allowed to start the checklist in section 8, not allowed without one.

Data classes

Classify by the most sensitive item in the set the agent can reach, not by the file you intend it to read. An agent pointed at a Clients folder can reach every subfolder unless the mount is scoped.

Two classes that are easy to miss:

• Secrets in files. API keys, passwords, tokens and .env files are not a data class; they are the keys to every class. An agent that reads them can use them, and anything it reads can appear in a vendor log. Section 6 covers this.
• Other people's regulated data. An accounting firm's Clients drive holds other businesses' PHI, card data and personnel files. The firm is a business associate or service provider for all of it and carries the obligation even though the data is not its own.

What the law requires, by regime

No US law yet says "AI agent" in the text that matters here. Each regime treats the agent's vendor as what it already knows: a business associate, a contractor, a service provider, a third party. That is enough to decide what has to be in place.

HIPAA (protected health information)

Applies to providers, health plans and their business associates, including an accounting or IT firm that handles a clinic's records. The vendor becomes a business associate the moment PHI reaches its servers in a prompt, a file or a tool call; HHS's cloud-computing guidance says this holds even for encrypted data the vendor cannot read. OCR's director confirmed at the April 2026 HIPAA Summit that the Security Rule applies to AI like any other technology, naming PHI exposure without a BAA and data leakage as the risks it is watching (summary). No AI-specific HIPAA rule exists as of this date.

Before an agent touches PHI: a signed BAA for that product and tier; a Security Rule risk analysis that names the tool; minimum-necessary scoping. Using a vendor without a BAA is a violation on its own, before any breach.

On a breach: notify the covered entity (if you are the BA) and affected individuals within 60 days of discovery; HHS within 60 days if 500 or more people, or in the annual log if fewer; local media if more than 500 residents of one state (rule). The burden of proving a disclosure was not a breach is on you.

Penalties per violation, adjusted January 2026 (91 FR 3665): $145 to $73,011 where you did not know; $1,461 to $73,011 for reasonable cause; $14,602 to $73,011 for willful neglect corrected within 30 days; $73,011 to $2,190,294 for willful neglect not corrected. Annual cap $2,190,294 per provision, with OCR's enforcement discretion lowering the practical caps on the first three tiers. Criminal penalties up to $250,000 and 10 years for intent to sell or harm.

Tax return information (IRC §7216 and §6713)

Applies to anyone who prepares returns for pay, and to contractors who receive return information from a preparer. "Tax return information" is anything obtained in connection with preparing a return: the return, the organiser, the W-2s, the working papers, the emails.

The gap: the IRS has not said whether sending return information to an AI tool is a "disclosure". The two defensible paths under Reg. 301.7216-2 and -3: treat the vendor as a contractor (written notice to the contractor of the §7216 rules, US-located processing, and SSN masking for anything offshore), or obtain the taxpayer's consent in the Rev. Proc. 2013-14 format: separate consent documents for use and for disclosure, 12-point type, the mandatory opening sentence, a one-year default duration, signed before any disclosure, never conditioned on getting the service. A blanket line in an engagement letter does not qualify.

IRS OPR guidance, June 2026 (Issue 2026-19): client data only through secure, enterprise-approved AI; nothing to public or unsecured systems; guard against cross-client data spillover; firm procedures under Circular 230 §10.36 must cover tool vetting, data handling, accuracy monitoring, documentation and breach procedures; disclose AI use to clients as appropriate.

WISP: the FTC Safeguards Rule names tax preparers as financial institutions, so a Written Information Security Plan is mandatory (IRS Pub 4557, template in Pub 5708), and the PTIN renewal asks you to acknowledge it. The AI vendor goes on the WISP's service-provider list and must be vetted, bound by contract and reassessed.

Penalties: §7216 is a misdemeanor, up to $1,000 and a year in prison per knowing or reckless violation. §6713 is strict liability: $250 per disclosure, $10,000 a year, rising to $1,000 and $50,000 when connected with identity theft. Circular 230 discipline up to disbarment from practice.

GLBA Safeguards Rule (financial data held by non-bank firms)

Applies to CPAs, tax preparers, bookkeepers, mortgage brokers, finance companies, debt collectors and state-registered advisers under the FTC; SEC-registered advisers follow Reg S-P instead; insurance agencies follow state insurance law (NAIC Model 668 where adopted).

Required program (16 CFR 314): a qualified individual in charge; written risk assessment; access controls, data inventory, encryption at rest and in transit, MFA for anyone reaching customer information, logging, secure disposal; staff training; service-provider oversight, which is where the AI vendor sits; an incident-response plan; an annual report to the owner. Firms holding fewer than 5,000 consumers' records are exempt from the written risk assessment, penetration testing, written IR plan and annual report, but not from the rest.

Breach notice (in force since May 2024, summary): unauthorised acquisition of unencrypted customer information affecting 500 or more people must be reported to the FTC within 30 days of discovery, into a public database. Reg S-P firms: customers within 30 days, service providers must notify the adviser within 72 hours.

Penalties: first violations usually produce a consent order; breaching an order or a penalty-bearing rule costs up to $53,088 per violation (2025 figure, 16 CFR 1.98).

PCI DSS v4.0.1 (card data)

Applies by contract, through your merchant agreement, to anything that stores, processes or transmits a primary account number or authentication data. All v4.0 requirements have been mandatory since March 31, 2025 (PCI SSC).

For agents the rule is simple: keep the agent out of the card data environment entirely. Tokenise through the processor, use a hosted payment page, and never let full card numbers or CVVs appear in files, screenshots, logs or tickets the agent reads. Requirement 12.10.7 even demands a procedure for when a PAN is found somewhere it should not be, which is the exact thing an agent crawling a drive will do.

Consequences: acquirer fees of $25 to $50 a month escalating toward $5,000 to $100,000 a month after six months of non-compliance; post-breach assessments of $5,000 to $100,000 plus forensic costs and card reissuance; loss of card acceptance (industry ranges).

State privacy and breach laws

Florida FIPA (Fla. Stat. 501.171) applies to any business holding Floridians' personal information: reasonable security measures, secure disposal, notice to individuals within 30 days of a breach, notice to the Attorney General within 30 days if 500 or more Floridians, and a 10-day deadline for a third-party agent (an accounting firm, a payroll provider, an agent operator) to tell the business it serves. Late notice costs $1,000 a day for the first 30 days, $50,000 per 30 days after, capped at $500,000 per breach. The Florida Digital Bill of Rights reaches only billion-dollar controllers and is not a factor for most firms. Florida's 2026 AI Bill of Rights passed the Senate and died in the House; no Florida AI statute of general application is in force.

For multi-state clients: Texas TRAIGA (effective January 1, 2026) bars AI built to discriminate or manipulate and requires health-care providers to disclose AI use; penalties $10,000 to $200,000 per violation; NIST AI RMF compliance is a defence. Colorado's rewritten AI law (SB 26-189, effective January 1, 2027) requires notice and a human-review path when automated tools materially influence decisions on employment, housing, lending, insurance or health care. Illinois requires notice when AI is used in employment decisions (since January 2026); California's ADMT rules phase in through 2027. Every state has a breach-notification statute; the clocks range from "without unreasonable delay" to 30 days, and most count from discovery.

Attorney-client privilege and trade secrets

Privilege. ABA Formal Opinion 512 (2024) and Florida Bar Opinion 24-1 require lawyers to review a tool's terms, retention and training settings before client data goes in, and to obtain informed consent before using a self-learning tool on it. In United States v. Heppner (S.D.N.Y., February 2026) a defendant's own conversations with a consumer AI about his defence were held neither privileged nor work product: the consumer terms allowed collection and training, so there was no reasonable expectation of confidentiality, and sharing the transcripts with counsel afterwards did not cure it. The court left open counsel-directed use on enterprise, no-retention tools. The practical rule for a business: anything you would not forward to an outsider does not go into a consumer-tier tool, and material you want privileged goes through your lawyer, not around them.

Trade secrets. Protection under the DTSA and Florida's UTSA depends on showing reasonable measures to keep the information secret. In Trinidad v. OpenAI the claim failed because the plaintiff had typed the material into ChatGPT under terms with no confidentiality obligation; that was a voluntary disclosure. An enterprise licence helps but is not sufficient on its own: the firm also needs a written AI-use policy saying what may be entered, a ban on personal accounts for work, access controls and logs, and training. Section 7 of this document is that policy.

Quick reference

Where your data goes, by vendor and tier

Checked against vendor pages on 2 November 2026. Terms change quarterly; rule 23 says to re-check on every major release. The pattern across every vendor is the same: consumer tiers train on your data by default or by a setting, offer no contract, and no BAA; business tiers do not train, carry a DPA, and only some products on some tiers carry a BAA. A BAA for a vendor's chat product does not cover its coding agent unless the page says so.

What the coding agents can reach on your machine

• Claude Code starts read-only in the working directory; edits, non-read-only shell and network tools prompt. The optional sandbox isolates the filesystem and limits network to a domain allowlist, but it has no built-in credential deny list: ~/.ssh, ~/.aws, .env and token variables must be listed explicitly (docs). Transcripts sit in plaintext on the local disk for 30 days.
• Codex CLI defaults to workspace-write with approvals on request; network is off inside the sandbox unless enabled; danger-full-access removes the sandbox entirely (docs).
• GitHub Copilot CLI and agent mode can edit files and run commands from the start directory, with prompts depending on the permission mode; network and credential controls are not documented (docs).
• Grok Bot is not local: it runs on a persistent cloud computer shared by all your bots, with your logins fed from a vault; running commands on your own desktop is opt-in and asks each time.
• OpenClaw defaults to a full host shell with approvals off and read-write filesystem access; sandboxing is opt-in. Its 2026 security record is poor: several critical CVEs, a finding that most exposed gateways had authentication bypasses, and a wave of 341 malicious plugins in its skill marketplace (known vulnerabilities). Run it only on a dedicated machine or VM, one instance per trust boundary.
• Hermes Agent runs commands as your OS user with a blocklist, a protected-path write deny list and an LLM-assessed approval step; the docs warn shell commands can still reach denied paths, and by default it borrows your Claude Code or Codex logins (security guide). Container backends skip the checks and treat the container as the boundary.

How to read the table for a decision. A "No" under BAA means PHI never goes in, whatever the salesperson says. A "Follows the account" under training means a Codex or Claude Code session on a personal Plus or Pro login is a consumer tool reading your client files. "Provider-dependent" for the open-source agents means the answer is the row for whichever API key you put in its config, and nothing the agent itself does changes that.

Not verified on 2 November: xAI's live consumer privacy policy (page did not load; training default taken from its FAQ), GitHub Copilot's HIPAA position (no primary page; third parties report no BAA), Microsoft 365 Copilot's SOC 2 inclusion, and the Antigravity CLI's machine-access model. Treat those cells as "assume the worse case until confirmed".

Agent-specific risks

Every documented agent data leak of 2025 and 2026 had the same shape: the agent could read private data, it was exposed to content an outsider controlled, and it had some path to the outside world. Remove any one of the three and the attack fails. That rule, known as the lethal trifecta, is the design principle behind rules 7 to 14.

Why agents differ from chatbots. A chat window reads what you paste. An agent reads what it finds: every file in the mount, every page it browses, every email, ticket and tool result. A model cannot reliably tell your instructions from instructions hidden in that content, so any text the agent reads can redirect it. Give it a shell, a browser, an email tool or write access, and that redirection becomes an action. This is prompt injection, OWASP's number-one risk for LLM applications, and it is the mechanism in every incident below.

What has actually happened

The risks, in the order they bite a small firm

1. Over-broad access. The agent is pointed at a whole drive, a whole mailbox or an admin database role because scoping takes an extra ten minutes. Every incident above started here.
2. Secrets in reach. .env files, key stores and tokens in the mount or the environment. Assume any secret an agent can see is public.
3. Outsider-triggered runs. An agent that acts on inbound email, public issues, support tickets or form submissions without a person in between. Split "read the untrusted thing" (no secrets, no network) from "act on it" (secrets, trusted input only).
4. Unrestricted network. A shell or browser with open egress. Even ping was enough once. Default-deny with a short allowlist.
5. MCP servers and plugins. They run with the agent's full privileges and, in most tools, outside the per-command sandbox. Each one is a dependency you have to vet, pin and review on change. Vendors review directory listings; they do not audit the code.
6. Memory and logs. Agents keep context across sessions and vendors keep transcripts. A regulated record read once can resurface in a later session or a support log. Retention terms (section 5) decide how long.
7. Agent-to-agent delegation. Sub-agents inherit the parent's access by default and widen the surface for poisoned instructions passed between them.
8. Irreversible actions on standing approval. "Always allow" on send, pay, delete or push turns a misread into a loss. Approval must be enforced by the tool's permission system, not by a sentence in the prompt.
9. Local is not private. A self-hosted agent still posts prompts to whichever model API it calls; the data leaves the building through the API key. Classify by the key's tier, not by where the agent runs.
10. Unpatched tooling. Agent CLIs and IDE integrations shipped critical fixes roughly monthly through 2025 and 2026. Auto-update on.

What government guidance says. CISA and partner agencies' joint guidance on agentic AI (May 2026) and NIST's draft Cyber AI Profile converge on a short list: a distinct identity per agent with least privilege, human approval for high-impact actions enforced in infrastructure, logging at the tool-call level, progressive rollout from low-risk tasks, and a way to interrupt an agent mid-task. The MCP specification's security page adds: minimum read scope first, no wildcard scopes, no token passthrough, and show the exact startup command for every server.

Insurance. Whether an agent-caused leak is covered depends on the policy wording, and AI exclusions are spreading on liability lines (ISO issued generative-AI exclusions for general liability effective January 2026) while affirmative AI endorsements are available from several cyber carriers. At renewal, ask the broker in writing whether an agent-caused leak, a deepfake-induced wire transfer and a vendor-side AI compromise are covered and under which part; request the affirmative endorsement; and keep the access record from section 8, because underwriters now ask for it.

The rules

Numbered so they can be cited ("per rule 12") in an SOP, a contractor agreement or an incident write-up. Each is a sentence a non-technical owner can enforce by asking a question.

The ten that matter most (paste these alone when the full list is too much; the numbers in brackets point to the full rule)

1. No agent touches a folder until its data class is written down. [1]
2. Consumer plans never see client or regulated data. [3]
3. PHI needs a signed BAA first; tax returns need the client's consent and a WISP that names the tool; card numbers never go in. [4]
4. Training off, retention known, both evidenced before the first file is read. [5, 6]
5. Smallest folder, read-only, on the agent's own revocable credential; secrets excluded from the mount. [7, 8, 9]
6. A person approves every send, payment, delete, permission change and production push, one at a time. [11]
7. Shell or browser means a network allowlist; otherwise anything it reads can leave. [12]
8. Everything the agent reads is untrusted; a file cannot change these rules. [13]
9. Log every action somewhere the agent cannot edit, and revoke when the task ends. [15, 17]
10. A suspected leak starts the breach clock the same day, from discovery, not from certainty. [20]

The full list

Before access

1. Classify first. No agent is connected to a folder, inbox, drive or database until someone has named its data class in writing. The most sensitive item sets the class.
2. Name an owner. Every agent deployment has one accountable person. Their name, the date and the scope go in the access record (section 8).
3. Consumer plans never touch confidential or regulated data. Free, Plus, Pro and Max tiers of any vendor are personal tools. Business use of client data goes through a Team, Enterprise or API tier with a DPA.
4. Regulated data needs the contract first. PHI requires a signed BAA from the vendor for that exact product and tier. Tax return information requires the client's §7216 consent (or a written determination that an exception applies) and a WISP that names the tool. Card data is never given to an agent.
5. Turn training off and prove it. Before the first file is read, the training setting is confirmed off and a screenshot or the contract clause is saved to the access record.
6. Know the retention. Write down how long the vendor keeps prompts and outputs, and whether zero-data-retention is on. If the answer is unknown, the class is capped at Internal.
7. Least privilege, read-only by default. The agent gets the smallest folder that does the job, mounted read-only. Write access is a separate decision with its own line in the record.
8. Scoped, revocable credentials. The agent uses its own token or service account, never a person's login, and never a credential that opens more than the task needs. The owner can revoke it in one step.
9. Secrets out of reach. .env files, key stores, password exports and credential files are excluded from the agent's mount, and the repository or drive is scanned for them before access is granted.
10. Minimise what it sees. Where the task allows, the data is redacted, sampled or exported with regulated fields removed before the agent reads it. An agent that needs a table's shape does not need its SSNs.

During use

1. Humans approve irreversible actions. Sending email, moving money, deleting files, changing permissions, posting publicly and pushing code to production require a person's explicit confirmation per action. No standing approval.
2. No outbound network beyond the allowlist. An agent with shell or browser access runs behind an egress allowlist. If it can reach any URL, it can exfiltrate to any URL.
3. Treat everything the agent reads as untrusted input. Documents, web pages, emails, tickets and tool results can carry instructions aimed at the agent. The rule book does not change because a file says it does.
4. One agent, one task, one scope. Do not reuse a session configured for one client's data on another client's work. Separate credentials and sessions per client, per data class.
5. Log everything. Tool calls, files read, commands run and outputs written are logged to a place the agent cannot edit, and kept at least as long as the underlying data's retention rule.
6. No agent-to-agent delegation without the same controls. A sub-agent inherits the parent's rules, scope and logging, not more.

After use

1. Revoke at the end. Credentials issued for a task are revoked when the task ends, and standing agents are reviewed at a fixed interval (quarterly at most).
2. Review outputs before they leave. Anything the agent produced that goes to a client, a regulator or the public is read by a person first, for accuracy and for leaked content from another source.
3. Keep the record. The access record, approvals, contracts and logs are retained with the firm's other compliance records and produced on request.
4. Report incidents on the clock. A suspected leak, an unexpected send, an agent acting outside scope, or a vendor breach notice starts section 9 the same day. The clock runs from discovery, not from certainty.

Vendor and tool selection

1. Prefer tools that publish their data terms. A vendor with no DPA, no retention statement and no security attestation is capped at Public data.
2. Self-hosted does not mean private. An open-source agent still sends prompts to whichever model API key it holds. Classify by that key's tier, not by where the agent runs.
3. Re-check terms on every major release. Vendor terms, defaults and products change quarterly. The access record names the version and the date the terms were checked.

Pre-deployment checklist and access record

Run the checklist for every new agent, every new data source added to an existing agent, and every vendor tier change. Every box ticked becomes a line in the access record below.

Checklist

• ☐Data class named for the full reachable scope, in writing (rule 1)
• ☐Accountable owner named (rule 2)
• ☐Vendor product and tier identified; consumer tier ruled out for anything above Internal (rule 3)
• ☐For PHI: BAA signed, covering this product and tier; copy filed
• ☐For tax return information: §7216 consent on file per client, or written exception analysis; WISP updated to name the tool
• ☐For GLBA data: tool added to the written security program's vendor list; security attestation (SOC 2 or equivalent) obtained
• ☐Card data confirmed absent from the scope
• ☐Training opt-out confirmed and evidenced (rule 5)
• ☐Retention period and ZDR status written down (rule 6)
• ☐Scope mounted read-only; write access, if any, separately approved (rule 7)
• ☐Dedicated credential issued with the minimum permissions; revocation path tested (rule 8)
• ☐Scope scanned for secrets and credential files; findings removed (rule 9)
• ☐Regulated fields redacted or excluded where the task allows (rule 10)
• ☐Human approval required for sends, payments, deletes, permission changes and production pushes (rule 11)
• ☐Egress allowlist in place for any agent with shell or browser (rule 12)
• ☐Logging to an agent-inaccessible store confirmed (rule 15)
• ☐Review date set (rule 17)
• ☐Cyber-insurance policy checked for AI-use conditions or exclusions; broker notified if the policy asks

Agent access record (one row per grant; keep with compliance records)

If something goes wrong

The clocks start at discovery, which the law reads as the day you knew or should have known, not the day you confirmed it. Suspecting is enough to start.

Day 0: contain and record

1. Revoke the agent's credentials and stop any scheduled runs. Do not delete logs, sessions or outputs; they are evidence and they are what tells you what left.
2. Write down what you know now: what the agent could reach, what it did, what left, where it went, who noticed and when. Timestamp it.
3. Pull the vendor's side: session transcripts, export of the conversation, support ticket requesting retention logs. Ask the vendor in writing whether the data was retained or used for training.
4. Decide, from section 3, which classes were in scope. That decides the clocks below.
5. Call counsel before anyone outside the firm is told. Notice under privilege is cleaner than notice drafted on your own.
6. Notify your cyber insurer per the policy's notice clause, which is usually days, not weeks, and usually a condition of coverage.

The clocks

Week 1: assess and notify

1. Run the HIPAA four-factor assessment if PHI was involved: nature of the data, who received it, whether it was actually acquired or viewed, and how far the risk has been mitigated. Document it; low probability of compromise is the only way out of individual notice, and you carry the burden.
2. Draft notices with counsel. Each regulator has a required content list; FIPA and HIPAA both want what happened, what data, when, what you are doing, and how to reach you.
3. Offer credit monitoring where SSNs or financial account data were exposed; several states expect it and insurers often fund it.

Month 1: close and fix

1. Write the incident report: cause, scope, timeline, notices sent, corrective action. File it with the access record (section 8).
2. Fix the control that failed, update the WISP or risk analysis, and re-run the checklist for every other agent with the same pattern.
3. If the vendor caused it, demand their incident report under the DPA or BAA and decide whether the tool stays.

The two mistakes that turn an incident into a penalty: waiting for certainty before starting the clock, and deleting the agent's session to "clean up". Both convert a reportable event into willful neglect.

Sources, disclaimer and review cadence

Disclaimer. This document is general information, not legal, tax or insurance advice, and reading it creates no professional relationship. Laws, vendor terms and penalty amounts change; the as-of date in the byline is the date they were last checked. Before relying on any rule here for a specific deployment, confirm it with a lawyer, a CPA or your broker, with your own facts in front of them.

Review cadence. Vendor rows in section 5: quarterly, and on any major release of a product named here. Penalty figures: each January, when the inflation adjustments publish. State law section: twice a year. Incident table in section 6: whenever a new agent incident is widely reported. The person who makes the change updates the byline date.

Primary sources used

Federal regulation

• HHS cloud computing guidance and Breach Notification Rule
• HIPAA civil penalty adjustment, 91 FR 3665, 28 Jan 2026
• Treas. Reg. 301.7216-3 and Rev. Proc. 2013-14
• IRC §6713
• IRS OPR Issue 2026-19, Responsible AI Use in Federal Tax Practice
• FTC Safeguards Rule, 16 CFR 314 and 16 CFR 1.98 penalties
• PCI SSC on v4.0.1

State law and ethics

• Fla. Stat. 501.171, FIPA
• Florida Bar Ethics Opinion 24-1
• Texas TRAIGA summary, Colorado SB 26-189 summary
• United States v. Heppner analysis, trade secrets and generative AI

Security and incidents

• OWASP Top 10 for LLM Applications and Agentic AI Threats and Mitigations
• The lethal trifecta
• CSA note on CI prompt injection in coding agents, CSA note on CISA agentic AI guidance
• MCP security best practices
• Claude Code security and sandboxing
• AI insurance exclusions and endorsements

Vendor terms are linked in each row of the section 5 table.