What did Israel's privacy regulator publish about AI agents?
In July 2026, Israel's Privacy Protection Authority published a document of rules and recommendations for responsible use of AI agents, as reported by Ynet. Notably, it is addressed to end users — the people granting agents access to email, calendars and files.
The Authority's CTO, Dr. Alex Blachman, explains that agents' memory is what enables autonomous analysis and actions with direct impact. In plain terms: the permissions you grant today keep working while you're not looking.
Why are agents riskier than chatbots?
The document names three risks, with one common thread: the agent sees and does far more than the task requires.
- Over-broad access — an email-sorting agent can analyze 15 years of correspondence when the task needs only the last 2 years.
- Profiling — the agent infers sensitive information, such as health status or financial habits, and may use it without explicit consent.
- Unintended disclosure — a health-assistant agent could expose medical information to a third party, e.g., a restaurant, without the user's knowledge.
What does the Authority recommend — and how do you apply it?
One principle: strict permission minimization. Grant the agent the smallest access its task requires — and not one item more. It is the classic data-minimization principle of privacy law, translated for the agent era.
| Authority recommendation | How to apply it in practice |
|---|---|
| Read-only access | No write or delete permissions — an agent that only reads can't break anything |
| Limited time ranges | The email agent gets the last two years, not the whole archive |
| Dedicated folders | Invoices in a separate folder — and the agent sees only that folder |
| Action plan up front | The agent presents what it intends to do before it does it |
| Calendar minimum | A scheduling agent sees free/busy only — no meeting content, no titles |
Three more instructions round it out: no transfer of information to third parties without approval, back up important files before granting access, and require human approval before critical actions.
Where do permissions stop — and what layer is missing?
Permissions decide which files the agent can reach — not what's inside them. Even a dedicated invoices folder is full of names, ID numbers, bank accounts and amounts. No permission setting hides those.
That's where the guidance's natural next layer comes in: document anonymization. When the agent gets a copy in which every identifier is replaced with a consistent token (PERSON_001), it completes the task fully — without seeing identities, and without raw material for profiling or unintended disclosure. Permissions minimize *which* files; anonymization minimizes *what's inside them*.
In that direction, BALMAS AI is building an agent gateway (MCP-based) that serves agents cleaned copies of files, with the processing done locally — in the spirit of zero retention: the original never leaves your machine.
Does this matter outside Israel?
Yes — regulator thinking travels. The playbook applies data minimization, the same principle GDPR enforces with fines of up to €20 million or 4% of global turnover. An end-user agent guide today previews what other regulators will ask tomorrow.
And agents land on fertile ground: per the Microsoft & LinkedIn Work Trend Index 2024, 75% of knowledge workers use AI at work and about 78% bring their own tools — the shadow AI pattern that agents only amplify. An organization that wants agents without data leaks should write both layers — minimal permissions and clean content — into its AI policy.