This article is part of our AI Agents for Business hub. Want help applying it? Talk to eSEOspace.
Your data is ready for an AI agent when you know what it can read and who owns each source. The content must also be current and consistent, and permissions must match who should see it. It needs to be good enough for one defined job, not perfect.
This checklist is part of our AI agents for business hub. It was checked against OWASP and NIST pages on 9 November 2026. It is general information, not legal advice, so have counsel review how personal data is handled.
Key Takeaways
- Judge data readiness against one job, not across your whole company.
- Conflicting documents cause wrong answers, and OWASP names this as a specific risk for retrieval systems.
- An agent should see only what the person it serves can see.
- Keep sensitive data out of agent context unless the job needs it.
- Keep a record of what was retrieved and when, so you can trace a bad answer.
Why this matters more for agents
An agent can answer from your documents through retrieval, covered in what is RAG. It can also act on what it finds. A wrong document can become a wrong refund, not just a wrong sentence.
OWASP lists this class of risk as Vector and Embedding Weaknesses. OWASP says: "Data federation knowledge conflict errors can occur when data from multiple sources contradict each other."
Start with one job
Write down the job, then list every source it needs. Everything else stays out of scope for now.
| Question | Example answer |
|---|---|
| What job? | Answer order status questions |
| What sources? | Order system, shipping policy, returns policy |
| Read or write? | Read orders, draft replies, no refunds |
| Who is served? | Customers, each seeing only their own orders |
| What would a mistake cost? | A wrong promise on delivery date |
The checklist
Mark each item Yes, No or Not applicable. A "No" is not a failure, but it is a task with an owner.
Ownership
- [ ] Each source has a named owner
- [ ] Someone can say when each source was last reviewed
- [ ] There is a process for updating a source when policy changes
- [ ] Staff know how to report a wrong answer
Accuracy and freshness
- [ ] Out-of-date documents are removed or marked
- [ ] Drafts are kept out of the agent's reach
- [ ] Prices, hours and policies have one authoritative home
- [ ] Each document shows an effective date
- [ ] Known errors in the source are fixed before launch
Conflicts
- [ ] You have searched for two documents that answer the same question differently
- [ ] Where sources disagree, one has been named the winner
- [ ] Regional and product exceptions are written down clearly
Format
- [ ] Key documents are searchable text, not images of pages
- [ ] Tables and forms come through intact when extracted
- [ ] Headings make each section understandable by itself
- [ ] Records use consistent names and IDs across systems
Permissions
OWASP's same entry says: "Inadequate or misaligned access controls can lead to unauthorized access to embeddings containing sensitive information." It recommends permission-aware stores, with strict partitioning between user groups.
- [ ] The agent applies the permissions of the person it serves
- [ ] Customers and tenants cannot see each other's records
- [ ] HR, legal and finance folders are excluded unless needed
- [ ] Removing someone's access also removes it for the agent
- [ ] Limits are enforced by the system, not by instructions to the model
Sensitive data
OWASP's AI Agent Security Cheat Sheet says: "Minimize sensitive data in agent context." It also says: "Implement data classification and handling rules."
- [ ] Data is classified (public, internal, confidential, regulated)
- [ ] Regulated data has been identified, and counsel has weighed in
- [ ] Payment details, ID numbers and passwords are excluded or masked
- [ ] You know where vendor logs and transcripts are stored and for how long
- [ ] You know whether your data can be used for model training
OWASP's entry on Sensitive Information Disclosure recommends limiting access to sensitive data based on least privilege. Vendor contracts decide much of the rest, so read the data terms.
Trust of incoming content
Your knowledge base can be attacked, or simply polluted by accident. OWASP's vector entry recommends validation pipelines, audits for hidden content, and accepting data only from trusted sources.
- [ ] You know who can add content to each source
- [ ] Customer-submitted content is treated as untrusted
- [ ] Web pages and emails are treated as untrusted
- [ ] Someone reviews new sources before they are connected
Read more in prompt injection for business owners.
Records and tracing
- [ ] You can see which document produced a given answer
- [ ] Retrieval and tool activity are logged
- [ ] Logs have a retention period and an owner
OWASP's vector entry recommends keeping detailed immutable logs of retrieval activities, so that suspicious behavior can be found quickly.
Write-back
If the agent changes records, the bar rises.
- [ ] You have a backup or a way to reverse changes
- [ ] Fields the agent may change are listed
- [ ] Changes are logged with the agent's identity
- [ ] High-impact changes wait for approval
How to score it
There is no pass mark that fits every business. Use this instead:
| Result | What to do |
|---|---|
| Permissions or sensitive data have open "No" answers | Stop and fix these first |
| Conflicts or freshness have open "No" answers | Fix them for the sources this job uses |
| Format has open "No" answers | Convert the documents this job relies on |
| Only minor gaps remain | Move to a small pilot |
NIST's AI Risk Management Framework is a broader option if you want a structure beyond this list. NIST says the framework is intended for voluntary use, and notes that it is being revised.
Test with real questions
A checklist only finds what you thought to look for. Take 20 to 50 real questions from your inbox or tickets and see whether the right document exists for each.
That step needs no new software. It also gives you the start of a test set, as our guide to how to evaluate an AI agent explains.
For a wider review of AI readiness, see our readiness assessment checklist.
Next step
Run this list for one job and give each "No" an owner and a date. If you want help connecting your records to an agent, with permissions scoped to the job, talk to our AI agent development team.
Frequently asked questions
Does my data have to be clean before I use AI?
Not everywhere. It needs to be clean enough for the one job you have chosen. Fix the sources that job relies on, and leave the rest for later.
Which data problems should I look for first?
We have no reliable statistic to give you. Conflicting and out-of-date documents are a known risk, and OWASP names conflicting sources specifically. Check your own sources for both.
Can an agent read everything in our shared drive?
It can if you connect it that way, so don't. Connect only what the job needs, and make sure it respects each person's existing permissions.
Should customer data go to an AI vendor?
That depends on your contracts, your obligations and the vendor's data terms. Have counsel review it, and find out where transcripts and logs are stored.
How do I know if the agent used the right document?
Require source tracing, so each answer can be tied to the documents retrieved. Without it, you can't tell a bad document from a bad answer.
