Skip to content
AI Security

Interview question · AI Governance, Risk & Compliance

How would you run a privacy threat model for an AI agent that reads email, calendars and documents on a user's behalf?

Security asks who can steal the data. Privacy also asks what the agent itself collects, infers, remembers and passes on, about the user and about everyone in their inbox who never agreed to anything.

mediumNewPreparation tags: Apple, Google, MicrosoftUpdated Nov 2026

Security asks who can steal the data. Privacy also asks what the agent itself collects, infers, remembers and passes on, about the user and about everyone in their inbox who never agreed to anything.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

10 answers per topic instead of 5, plus saved progress and bookmarks · costs nothingor unlock all 529 remaining answers · $25

Every worked answer in all 17 topics, every lesson in every course, the full concept curriculum, the complete practice-test bank, and the downloadable security field guides.

6 months · One payment · No auto-renewal

What if · the follow-ups in this answer

The answer works through 6 follow-ups like an interviewer would

An agent reads users' calendars, email and documents to schedule meetings and draft replies, and keeps memory between tasks.

  1. Which personal data flows do you map?
  2. What questions do you ask of each flow?
  3. What about third parties in the emails?
  4. What if memory keeps inferred personal data?
  5. What if the agent hands tasks to other agents or tools?
  6. How would you use the threat model?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Premium opens every answer and ladder.

UP NEXT ON YOUR JOURNEY
Next in this trackWhat are frontier safety frameworks such as Anthropic's RSP and OpenAI's Preparedness Framework, and what do they ask of security teams?Next in this trackWhy are the most cyber-capable AI models released only to vetted defenders, and how would you govern your company's access to one?Next in this trackHow do C2PA Content Credentials and AI watermarks differ, what can each prove about an image, and how would you use them in a product?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.