Trust and control risks
The primary governance risk is not access to data, but the combination of implied authority and lasting records. Email is where informal approvals happen, intent is inferred, and context often matters more than exact wording.
When an AI agent operates in this environment, its outputs can turn fleeting signals into durable artifacts, influencing decisions and creating records that extend beyond the original exchange.
“CIOs have to be careful about how these AI agents access, process, personalize, and share information,” Shah said. “If an employee switches roles or leaves, how is the knowledge secured with all privacy protocols in place?”
What often catches enterprises off guard, Gogia said, is that AI does not simply process information but creates new artefacts. In many cases, those summaries, extracted actions, inferred priorities, and generated content can persist beyond the moment they are created.
