How an energy company's HR team found which AI agents could reach employee data

An HR team at a global energy company works with some of the most sensitive data the company holds: CVs, interview notes, references, right-to-work records, employee relations cases, payroll, absence records, and performance reviews. That data doesn't sit in one system. It's spread across the applicant tracking system, the HR information system, email, shared drives, and documents people download to their devices.

The team already used AI assistants alongside those systems. Some had been adopted without a formal review. HR, privacy, and IT & Security teams agreed on the question to answer first: which candidate and employee data could those agents reach, and which access was part of an approved HR workflow?

A survey would only show the tools people remembered using. The team wanted evidence from the devices, and it wanted to keep the AI tools that saved HR time.

The scope was the 100 devices used for recruitment and employee casework. IT rolled out the Endpoint Agent through Jamf over three months. Supply Chain found at least one AI agent on 75 of them, and listed the skills and connectors each agent loaded. 34 connectors reached the applicant tracking system, the HR system, email, or shared drives. The team blocked 4 skills after the first inventory.

Runtime ran in log-only mode for the first month, with rules covering reads of protected HR folders, such as payroll, health, employee relations, and right-to-work, and uploads to destinations outside the approved list. Hundreds of agent reads a week matched the protected-folder rule. Some came from expected work, such as drafting an interview plan from an approved template. Others showed that the same agent could reach far more sensitive material than its task needed.

Control Plane received which agents and components were installed and which rule each action matched. Candidate and employee data, prompts, usernames, and file paths stayed on each device, so the review itself moved no HR data anywhere.

The log-only month gave the team a baseline of normal HR work. From the second month, the rules on protected folders and on uploads outside the approved list started asking for approval or blocking. Each week, Runtime blocks or sends for approval 17 uploads or sends to destinations outside the approved list.

Across all 100 devices, the team sees 9 approval requests a week out of 1,600 checked actions. Everything else in HR's daily work runs without a prompt, so nobody had to ban AI in HR to get control of the data.

The privacy and security teams now have a record to review data minimization, purpose limitation, and access controls with HR, without asking HR to rebuild what happened from memory. Decisions about which uses are acceptable stay with those teams. What people type or paste into a prompt sits outside what Signals Corps covers.