Give AI agents real data. Keep it need-to-know.
Slack, Drive and GitHub already know who can see what. Dyeline applies those rules to what your agents say and send, even when one is tricked.
Pre-release. Our free MCP check found that 1 in 6 of 630 public configs could leak private data.
A Slack agent with access to Drive
“Can you sum up the Q4 plan?”
Example.
- Reply in
#generalBlocked214 people. Only 4 can open the deck. - Message to MayaSent1 person. She can open the deck.
One security layer for your agents.
Reply in #general
Slack agent. Maya asked in #general.
- Sources
Q4 board deck.pdf4 people can open it- Audience
#general214 people- Why
- 210 of 214 people in
#generalcan’t openQ4 board deck.pdf. - Then
- The agent sent it to Maya instead.
- Policy
need-to-know
Map synced 2 minutes ago. No answer counts as a block.
Preview, example data.
- MCP checkLiveFinds where an agent’s tools could leak data. Free, in your browser.Check your MCP config
- Permission mapBuildingWho can open each file, channel and repo in Google Workspace, Slack and GitHub.
- Audience checkBuildingChecks every reply, post and email against the permission map before it goes out.
- Audit trail and reportsPlannedWhat each agent showed to whom, and why. For your auditors, or your customer’s.
Selling an agent to enterprises? Bring one deal that’s stuck in security review. Request a pilot
Agents don’t check who sees the answer.
“Channel Agent could summarize the content of items that one or more users in the channel don’t have permissions to open.”
| Who could see it | Case | What happened | Kind |
|---|---|---|---|
| The public | PixelLeak, 2026 (opens in a new tab) | Coding agents pushed more than 13,000 internal screenshots to public GitHub repositories. | Accidental |
| Another company’s users | Asana, 2025 (opens in a new tab) | Its AI connector could expose one company’s projects to users at another. | Accidental |
| A public repo’s readers | GitHub MCP, 2025 (opens in a new tab) | A public issue got an agent to copy private-repo data into a public pull request. | Research |
How it works.
- Connect your apps.Dyeline reads sharing from Google Workspace, Slack and GitHub. No rules to write to start.
- Call Dyeline before your agent posts.Your code passes where the reply is going and every source in the agent’s context, so a tricked model can’t leave one out. Agents on the OpenAI or Anthropic APIs can route through Dyeline instead.
- Each reply gets a decision.If someone who’d see it can’t open its sources, it’s blocked. The agent is told why, and can send it privately or leave that source out.
// Before the agent posts. No answer counts as a block.
const check = await dyeline.check({
destination: "slack:#general",
sources: ["drive:Q4 board deck.pdf"],
});
check.decision; // "block"
check.reason; // "210 of 214 can't open the deck"
check.instead; // "slack:dm:maya": she can open itIf your apps wouldn’t show it to someone,your agents won’t either.
A permission check decides, not a model, so it holds even when an agent is tricked. Unknown destinations count as public.
Covered
- Data from apps you connect, and anything made from it.
- Data from apps you haven’t connected, which only goes to the person who asked.
- Replies, posts, emails and web requests.
Not covered
- Agents you buy, until their vendor calls Dyeline.
- Permissions that are already too wide.
- Copies made after delivery, like forwards and screenshots.
Questions.
Request a pilot.
Selling an agent to enterprises? Bring one deal that’s stuck in security review. We test your agent and write the report for that customer. Building agents for your own company? Start in shadow mode.
What happens next
- We reply within two working days.
- A 30-minute call about your agent and what it reads.
- A pilot plan, agreed with your security team or your customer’s.
A paid pilot includes
- The permission map and the audience check, on one agent.
- Shadow mode first, so nothing is blocked until you turn enforcement on.
- Measured map accuracy, latency and wrongly blocked replies.