There is a category of AI deployment that I treat with significantly more caution than others: AI agents that have read or write access to data about individual employees.
The caution is not about the AI being untrustworthy in an abstract sense. It is about the specific combination of capabilities, data sensitivity, and audit requirements that come together when employee data is involved. Get this wrong and you are not dealing with a bug. You are dealing with a data protection incident.
Here is the security model I apply consistently across these deployments.
Principle one: Separate read agents from write agents. Always.
I have seen architectures where a single AI agent has both read access to employee records and write access to update them based on reasoning. This makes me uncomfortable regardless of how good the reasoning logic is.
