انتقل إلى المحتوى الرئيسي

Configure DLP policies for agent grounding data sources

Implementation Effort: Medium – Requires identifying the data sources agents use for grounding, extending DLP policy scope to cover those sources, and coordinating with data owners to validate that labeling and classification are in place on grounding content.
User Impact: Medium – Agents may lose access to data sources they previously used for reasoning if those sources contain content that DLP policies restrict, affecting the quality and completeness of agent responses.

Overview​

Data Loss Prevention policies configured at the Microsoft 365 Copilot and Agent 365 interaction level prevent AI services from including highly classified content in responses — but they operate at the point of output, after the agent has already accessed and processed the grounding data. DLP for agent grounding data sources operates upstream, protecting the data sources that agents rely on to reason and generate responses. This means applying DLP and sensitivity labeling policies directly to the SharePoint sites, OneDrive locations, and other repositories that agents query during execution, preventing agents from accessing sensitive content that should not inform AI decisions or outputs in the first place.

The distinction matters because interaction-level DLP catches sensitive content at the response boundary, while grounding-data DLP prevents the content from entering the agent's reasoning process entirely. An agent grounded on a SharePoint site containing documents labeled "Highly Confidential" may still reason over that content and generate derivative insights even if the DLP policy blocks the labeled content from appearing in the final response. Grounding-data DLP closes this gap by ensuring agents cannot access or use the sensitive content for any purpose — not just display. This is particularly important for Agent 365 instances, where agents must be explicitly granted access to files and where sensitivity label encryption must grant the agent VIEW and EXTRACT usage rights. If an agent instance does not have the appropriate rights, the content is inaccessible by design, but organizations must verify that this enforcement is consistent across all grounding data sources.

This supports Use least privilege access by restricting agent access to grounding data based on the content's classification, ensuring agents only reason over content they are authorized to use — not just content they are authorized to display. It supports Assume breach by adding a defense layer at the data source level so that if an agent is compromised or manipulated through prompt injection, the sensitive grounding data is already protected and inaccessible, limiting the blast radius to non-sensitive content. Without DLP policies on grounding data sources, organizations protect the agent's output but leave the agent's input unprotected — threat actors or careless configurations can lead agents to reason over content that the organization never intended to expose through AI-mediated access.

Reference​