An agent may encounter instructions inside emails, webpages, PDFs, tickets, or retrieved records. Those instructions can conflict with the user’s goal and attempt to redirect tools or expose data.
Employees change roles, projects end, vendors add scopes, and old tokens remain active. AI connectors make those ordinary identity problems more consequential because one interface can reach several systems.
Content Credentials can provide tamper-evident provenance assertions about creation and editing. A careful review checks validation, signer, actions, ingredients, and gaps before drawing a conclusion.
A provider can promise not to train on customer inputs while still retaining abuse-monitoring logs or application state. Buyers need separate answers about purpose, duration, access, region, deletion, and exceptions.
A classroom pilot can involve student writing, behavior, accommodations, identity, grades, voice, images, and teacher feedback. The learning goal should be clear before any of that enters a system.
A browser agent can encounter saved sessions, passwords, payment pages, private messages, destructive controls, and adversarial web content. Isolation should be designed before convenience.