Skip to content

News

What the Five Eyes agentic AI guidance means for connecting an assistant to a deal room

By the CogniSuite team

What the six agencies told you not to do

Do not give an AI agent broad or unrestricted access to sensitive data. That is the headline instruction in Careful Adoption of Agentic Artificial Intelligence (AI) Services, published 1 May 2026 by CISA, the NSA and their Australian, Canadian, New Zealand and UK counterparts. The rest is operational:

  • Give each agent its own verifiable identity. No shared service credential.
  • Least privilege per task, with temporary credentials for sensitive actions.
  • Monitor internal steps, not just inputs and outputs.
  • Keep a human approval step in front of irreversible actions.
  • Start narrow. Widen autonomy as controls mature.

Why a data room is the hard case

A data room runs on unequal access, so an assistant holding one room-wide credential breaks it by design. Different bidders see different folders, and sell-side working files are not for the buyer. On a buy-side mandate the external party is the seller. A lawyer or a signed agreement put each boundary there, and several cover material non-public information.

The failure mode is rarely a denied download in the log. It is a correct answer carrying a number the reader was never cleared to see, drawn from a folder they cannot open.

The UK NCSC's December 2025 assessment argues prompt injection will probably never be mitigated the way SQL injection was: a language model has no internal boundary between instructions and data. Its conclusion: "Design protections need to therefore focus more on deterministic (non-LLM) safeguards that constrain the actions of the system."

So the question for any legacy VDR connector is not whether it is encrypted. It is whose permissions the retrieval runs under.

How CogniSuite scopes it

The assistant runs as the person asking. No service account holds room-wide read, and no tool surface is exposed to an outside assistant.

  • One retrieval path. Every AI feature uses the same function, and the folder check decides what enters the candidate set rather than trimming results afterwards. A document you cannot read is never a candidate.
  • The same check the file browser uses. Four grades of folder access: per-user overrides over organisation grants over inherited parent grants.
  • Deal-side aware. The room knows whether the mandate is buy-side or sell-side, so the counterparty is identified correctly rather than assumed.
  • One database and one subdomain per deal. Cross-deal retrieval is not a rule the model follows. There is nothing on the other side to reach.
  • Counterparty drafts scoped to the audience. Grounding uses what the receiving side may read, from the organisation baseline, so a per-user override cannot widen it. Several viewers produce an intersection. Unresolved ownership denies rather than falling back to the banker's access.
  • Citations verified in code, not by a model. Every cited document must sit in the permitted set and the quote must appear in it. Failing citations are dropped; an affirmative answer with no verifiable citation is replaced by a routing note for human review.
The data room AI chat. Retrieval runs under the asking user's folder permissions.
The data room AI chat. Retrieval runs under the asking user's folder permissions.

What we do not claim

  • Retrieval treats folder access as binary. Any folder you may read at all is eligible, including view-only ones, so an answer can quote a document you may view but not download. Set those to no access for a harder line.
  • Watermarking is visible, not forensic. It covers PDF, Word, images, Excel and PowerPoint, and a format that cannot be marked is refused rather than served clean. A determined recipient can still strip the mark.
  • Prompt guardrails are mitigation, not a boundary. The structural controls above are what hold.
  • The audit log is not tamper-evident. It records actor, action and target for views, downloads, permission changes and AI questions, and exports to CSV. Only the advising firm can read it: an oversight tool, not a mutual record.
  • Sign-in is an emailed one-time code, or single sign-on for your own firm. Single sign-on is OpenID Connect, configured per firm and restricted to the email domains you nominate, and it covers your firm's workspace users. Counterparties in a deal room use the emailed code. We enforce no second factor of our own, so that control sits with your identity provider. See /security.

Questions to ask before you connect anything

  • Whose identity does retrieval run under, the asking person's or a service account's?
  • Is the permission check the same one the file browser uses, or a second implementation?
  • Is it applied before ranking or after?
  • When scope cannot be resolved, does it deny or fall back to something broader?
  • When output goes to a counterparty, whose access defines the grounding set?
  • Which of these are enforced in code, and which are asked for in a prompt?

That last question separates most claims from most implementations.

Sources

General information, not legal, tax or financial advice. For how CogniSuite handles security and access, see Security. To see it on a live deal, book a walkthrough.

← All articles