How do I prove my AI agents are not exfiltrating data?

A negative is proven by controls that would have caught the positive. For agents that means every outbound action authorized before it runs, content scanned for credentials and injection, behaviour compared against the agent's own baseline, and a record that shows what happened when the controls fired.

Nobody can prove an absence directly. What an auditor, a customer or a regulator will accept is a set of controls that would have detected and stopped exfiltration, operating over the period, with the evidence that they ran. For AI agents the controls are specific, because the exfiltration paths are specific: an agent with credentials sends data where its principal did not intend, an injected instruction turns a helpful action into a leaking one, or an agent's behaviour drifts from its purpose one small step at a time.

The four controls and what each catches

• Authorization before the act. Every governed action is checked against the agent's tier and policy before it runs; an action outside scope is refused, and the refusal is recorded. The path that sends data is the path that is governed.
• Content scanning on the way in and out. Credentials, malicious payloads and injection phrases are detected in the content agents handle; critical findings quarantine, others strip. The expressions the scanner compiles are decided by a policy the commit gate re-applies, so the list cannot widen or narrow unnoticed.
• Behavioural monitoring against the agent's own baseline. Frequency spikes, privilege probing, scope escalation and identity drift are flagged or halted; exfiltration rarely looks like one event and usually looks like a changed pattern.
• A tamper-evident record. Every decision above lands in a hash-linked audit chain that can be exported and independently verified, so the proof is not the platform's word but a record a third party can re-check.

What the adapters send, and never send

The controls themselves must not become the leak. Each shipped adapter publishes a capability profile stating exactly what it sends to the control plane and what never leaves the host: the MCP gateway sends the agent identity, the action class and the tool name with its argument key names, and never the argument values or the server's responses. The profile is bound to the source that implements it and re-verified on every commit.

Proof of no exfiltration is a record of the controls that would have caught it, running, with nothing to report.

Where to verify this yourself

• Adapter capability profiles, with what each adapter sends and never sends: agentomy.com/adapters.json.
• Pattern provenance, the expressions the runtime evaluates and how each is tested: agentomy.com/docs/patterns.
• The data-residency answer per deployment mode: agentomy.com/manual.