Data controls are rules and technical safeguards that determine what information a system can access, process, share, or retain. They can include access permissions, limits on data retention, restrictions on sending information to external services, and rules for handling sensitive records.
In cybersecurity, these controls reduce exposure if an account, application, or AI agent is misused or compromised. For example, an organization can restrict an assistant to specific documents, prevent it from retaining prompts, and require approval before it shares sensitive content or changes records. Effective controls should follow least privilege, be monitored through logs, and be reviewed as systems and their access needs change.