Predictika · Guardrails for workplace AI agents

A workplace AI agent's post, email or publish action, checked before it goes out

An AI agent that reads company knowledge also acts on it: it posts to channels, emails customers and publishes new agents. Before the action goes out, the agent sends it to Predictika, which checks the sensitivity of every source behind the answer, who can read the destination, the tools and recipient limits the agent has, and any human sign-off, and returns a verdict and every reason.

Scope: Agent actions that send knowledge out — channel posts, customer and prospect email, tickets, CRM record updates and publishing an agent. See everything this validator covers

This validator checks what an AI agent is about to do with company knowledge, for a fictional company, Brightwater Systems. It does not retrieve documents or write the answer: the knowledge platform and the agent do that. The validator checks the action the agent has prepared before it is released. This is a generic version; it is not tied to any one knowledge platform.

  • Sensitivity — each source behind an answer has a class (public, internal, confidential, restricted) and each destination accepts content up to a class. A source above what the destination accepts is blocked, and a second source is checked the same way.
  • Audience — a source locked to one team cannot go to a destination that is not that team's audience, because access to the source would not carry over.
  • Tools and volume — an agent can only act through the tools it was given; an email to more than 200 recipients is blocked and one to 26 to 200 needs a manager.
  • Outside the company — internal content going to an outside recipient needs a manager's sign-off.
  • Sign-off — an approver must be a human manager or admin and cannot be the person the agent acts for.
  • Records and publishing — CRM field and discount limits, and publishing an agent that combines confidential knowledge with outside email (blocked) or is shared company-wide (admin sign-off).

Any agent action that posts, emails, creates a ticket, updates a CRM field or publishes an agent is in scope — not only the scenarios pictured here. Not covered: retrieving or ranking documents, writing the answer, document-level permission syncing, and data loss prevention scanning of the text itself. Classes, department locks, the 200 and 25 recipient limits and the approval roles are illustrative company policy.

The AI workplace agentReads the knowledge it was asked about, drafts the action and says it is ready.
Predictika validatorChecks every rule at once and returns the verdict, each finding, and the computed figures.

6 scenarios in 3 groups · each group runs from the agent’s first attempt to the outcome · click one to switch

What the agent proposes

The AI workplace agent says

Illustrative agent statement. The validator receives the structured request below.

Proposing agent: AI workplace agent (scripted)

Before sending, the agent must call Recorded run

Predictika validator


      

        
        
        
      

      
Waiting for the call.

      
    

  

  
  

    
Where document permissions alone get it wrong
Click to expand
    
Our assessment of what a knowledge platform's document permissions, and the agent's own judgment, do with the same cases. It is a judgment about what such permissions are built for, not a claim that nothing can be built around them.

    
What the validator caughtTypical permissions-only setupPredictika
A restricted or confidential source repeated in a wider channel or to a customer listOnly with workarounds
Source permissions decide who may read a document. Once the agent has read it, where the answer goes is the user's choice; labels per destination can be built, and each has to be kept in step with the sources.		Source class and destination limit are inputs; each source behind the answer is checked against the destination.
A team-locked source going to a different audienceOnly when someone is vigilant
Nothing in the read permission says who may see the answer. Someone has to remember that the audience of the destination is different from the audience of the source.		The department lock of each source is compared with the destination's audience, for both sources when an answer draws on two.
Two sources in one answer, each needing its own checkOnly with workarounds
Checks are usually written per document. An answer that blends two documents needs the destination checked against both, and a rule per pairing.		The same checks run for the first and the second source, together, in one call.
A mass email with a sign-off that does not countOnly when someone is vigilant
A recipient cap can be set per tool. Whether the person who signed off is a manager other than the person the agent acts for is a rule most workflows leave to convention.		Recipient count and approver are inputs; over the cap is blocked, and the approver must be a human manager who is not the agent's own user.
Publishing an agent that mixes confidential knowledge with outside emailNot what it is built for
The agent builder lets a user choose knowledge and tools separately. The dangerous combination is a property of the whole configuration, which each choice taken alone does not show.		The knowledge level and the outside-email tool are inputs of one check; the combination is blocked.
Every problem returned in one answerOnly with workarounds
Checks that run at different steps tend to surface one problem at a time, so the next one shows only after the first is fixed.		All findings come back together, whatever order the choices arrived in.

  

  

    
What this validator catches: findings from its test cases
Click to expand
    
Every rule is checked on every call, in any order the choices arrive; one problem never hides another. Blocking findings stop the request; approval findings need a person to sign off; everything else is computed.

    
1The answer draws on FY27 revenue forecast, classified restricted, but #company-announcements (all employees) accepts only internal content or lower.
2FY27 revenue forecast is restricted to the Finance team, but #company-announcements (all employees) is not a Finance audience. Access to the source would not carry over to this destination.
3The answer draws on Partner pricing and discount policy, classified confidential, but #support-floor accepts only internal content or lower.
4Partner pricing and discount policy is restricted to the Sales team, but #support-floor is not a Sales audience. Access to the source would not carry over to this destination.
5Partner pricing and discount policy is restricted to the Sales team, but #finance-leadership is not a Sales audience. Access to the source would not carry over to this destination.
6The answer draws on Product roadmap FY27, classified confidential, but Customer contact at Northwind Retail (under contract) accepts only internal content or lower.
7Internal content is leaving the company, to Customer contact at Northwind Retail (under contract). A human manager must sign off first.
8The sign-off by Dana Reyes - Support Specialist does not count. An approver must be a human manager or admin and cannot be the person the agent acts for.
9This email goes to 340 recipients. Agents may not send to more than 200 recipients.
10This email goes to 60 recipients. More than 25 needs a human manager to sign off first.
11Finance analyst agent (for Omar Haddad) has no tool for this action. Its agent permissions do not include it.
12The answer draws on Compensation bands, classified restricted, but Jira project SUP (support tickets visible to contractors) accepts only internal content or lower.
13Compensation bands is restricted to the HR team, but Jira project SUP (support tickets visible to contractors) is not a HR audience. Access to the source would not carry over to this destination.
14The agent says policy allows up to 30.0 percent, but the Gold tier ceiling for Northwind Retail is 20.0 percent.
15A 28.0 percent discount is above the 20.0 percent ceiling for Northwind Retail.
16A 24.0 percent discount is above the 20.0 percent ceiling for Northwind Retail.
17Raising the discount from 8.0 to 18.0 percent is a jump of more than 5 points. A human manager must sign off first.
18Agents may not change the CRM field Account tier.
19Support agent (for Dana Reyes) has no tool for this action. Its agent permissions do not include it.
20This agent reads confidential or restricted knowledge and can also send email outside the company. That combination is not allowed.
21This agent reads confidential knowledge and is shared with the whole company. A human admin must sign off first.

  

  

    
Scenarios and results
Click to expand
    
The recorded result of the validator for each scenario on this page: the request the AI agent sent, the verdict, and every finding, in the order they appear above.

    
1. Customer email: The sales agent emails two confidential sources to a customer list

    
The agent's request. Please email a summary of the partner discount policy and the FY27 product roadmap to the 340 contacts on the Northwind distribution list. Sam Ito has approved this email. It is ready to go.

    
Verdict: Blocked.

    
    
      
  • Source too sensitive for the destination. The answer draws on Partner pricing and discount policy, classified confidential, but Customer contact at Northwind Retail (under contract) accepts only internal content or lower.
    • 
      
  • Second source too sensitive for the destination. The answer draws on Product roadmap FY27, classified confidential, but Customer contact at Northwind Retail (under contract) accepts only internal content or lower.
    • 
      
  • Source access would not carry over. Partner pricing and discount policy is restricted to the Sales team, but Customer contact at Northwind Retail (under contract) is not a Sales audience. Access to the source would not carry over to this destination.
    • 
      
  • Too many recipients for an agent email. This email goes to 340 recipients. Agents may not send to more than 200 recipients.
    • 
      
  • Sign-off does not qualify. The sign-off by Sam Ito - Sales Representative does not count. An approver must be a human manager or admin and cannot be the person the agent acts for.
    • 
    

    
2. Customer email: The agent resubmits after fixing the errors

    
The agent's request. Please email the account setup steps from the support runbook to the 60 contacts on the Northwind support list. Lee Okafor has approved this email. It is ready to go.

    
Verdict: Allowed.

    
    
      
  • Internal content going to an outside recipient. Internal content is leaving the company, to Customer contact at Northwind Retail (under contract). A human manager must sign off first.
    • 
      
  • Large recipient list (26 to 200). This email goes to 60 recipients. More than 25 needs a human manager to sign off first.
    • 
    

    
3. Channel post: The finance agent posts the revenue forecast company-wide

    
The agent's request. Please post the FY27 revenue forecast summary to #company-announcements. It is ready to go.

    
Verdict: Blocked.

    
    
      
  • Source too sensitive for the destination. The answer draws on FY27 revenue forecast, classified restricted, but #company-announcements (all employees) accepts only internal content or lower.
    • 
      
  • Source access would not carry over. FY27 revenue forecast is restricted to the Finance team, but #company-announcements (all employees) is not a Finance audience. Access to the source would not carry over to this destination.
    • 
    

    
4. Channel post: The agent resubmits after fixing the errors

    
The agent's request. Please post the FY27 revenue forecast summary to #finance-leadership. It is ready to go.

    
Verdict: Allowed.

    
5. Publishing an agent: An agent published with finance knowledge and an email tool

    
The agent's request. Please publish the Quarter Close Helper agent with the finance knowledge collections and the Gmail send tool. It is ready to go.

    
Verdict: Blocked.

    
    
      
  • Restricted knowledge plus external email. This agent reads confidential or restricted knowledge and can also send email outside the company. That combination is not allowed.
    • 
    

    
6. Publishing an agent: The agent resubmits after fixing the errors

    
The agent's request. Please publish the Quarter Close Helper agent with the finance knowledge collections and no outside email tool. It is ready to go.

    
Verdict: Allowed.

  

  

    
Narration transcript
Click to expand
    
The text of the narrated walkthrough, step by step.

    
    
      
  1. Welcome to a demo of Predictika's Validator. An AI agent that reads company knowledge also acts on it: it posts to channels, emails customers and publishes new agents. Before the action goes out, the agent sends it to Predictika, which checks the sensitivity of every source behind the answer, who can read the destination, the tools and recipient limits the agent has, and any human sign-off, and returns a verdict and every reason.
    2. 
      
  2. I will start with the first request by the agent.
    3. 
      
  3. The agent says. Please email a summary of the partner discount policy and the FY27 product roadmap to the 340 contacts on the Northwind distribution list. Sam Ito has approved this email. The rest of the request is on screen.
    4. 
      
  4. Before it goes out, the agent calls the validator.
    5. 
      
  5. Blocked, with five findings, all in one answer. The answer draws on Partner pricing and discount policy, classified confidential, but Customer contact at Northwind Retail (under contract) accepts only internal content or lower. The answer draws on Product roadmap FY27, classified confidential, but Customer contact at Northwind Retail (under contract) accepts only internal content or lower. Partner pricing and discount policy is restricted to the Sales team, but Customer contact at Northwind Retail (under contract) is not a Sales audience. Access to the source would not carry over to this destination. The other two are on screen.
    6. 
      
  6. The validator returned five blocking findings in one answer. A check that reads one field at a time would pass most of this; it shows only when the choices in the action are checked against each other.
    7. 
      
  7. What this shows: for a mass email with a sign-off that does not count, a permissions-only setup does this reliably only when someone is vigilant.
    8. 
      
  8. Now the agent resubmits.
    9. 
      
  9. The corrected request. It changes the sources to support runbook, the recipients to 60 and the approver to Lee Okafor.
    10. 
      
  10. It calls the validator again.
    11. 
      
  11. This time the validator clears it.
    12. 
      
  12. All five earlier findings are cleared.
    13. 
      
  13. Five problems caught in one call, fixed in one pass, and a clean action. That is the value of Predictika's validator: catching mistakes before the action runs.
    14.