---
title: "AI agent security: a bounded mandate | Abbiamo.ai"
description: "AI agent security: Abbi Actions no one expands, conversation locks, data isolated per client, encryption and auditable change control."
---

[Skip to content](https://abbiamo.ai/en/solutions/security#contenido) ![Abbie, AIE agent by Abbiamo.ai](https://abbiamo.ai/hubfs/raw_assets/public/ABBIAMO/images/abbie-retrato.jpg)

[![Abbiamo.ai](https://abbiamo.ai/hs-fs/hubfs/Abbiamo.ai/brand/logo-dark/abbiamo-ai-logo-dark-480.webp?width=224&height=36&name=abbiamo-ai-logo-dark-480.webp)](https://abbiamo.ai/en)

Menu

[Home](https://abbiamo.ai/en) [Abbie](https://abbiamo.ai/en/abbie) [Caddie](https://abbiamo.ai/en/caddie) [Abbi Studio](https://abbiamo.ai/en/abbi-studio) [Abbi PitWall](https://abbiamo.ai/en/abbi-pitwall) [Services](https://abbiamo.ai/en/services) [Solutions](https://abbiamo.ai/en/solutions) [Industries](https://abbiamo.ai/en/industries) [Contact](https://abbiamo.ai/en/contact)

[ESEspañol](https://abbiamo.ai/soluciones/seguridad)[ENEnglish](https://abbiamo.ai/en/solutions/security)[ITItaliano](https://abbiamo.ai/it/soluzioni/sicurezza)[PTPortuguês](https://abbiamo.ai/pt/solucoes/seguranca)

EN

Idioma · Language · Lingua

- [ESEspañol](https://abbiamo.ai/soluciones/seguridad)
- [ENEnglish](https://abbiamo.ai/en/solutions/security)
- [ITItaliano](https://abbiamo.ai/it/soluzioni/sicurezza)
- [PTPortuguês](https://abbiamo.ai/pt/solucoes/seguranca)

Solutions · AI agent security

# AI security: a bounded, traceable mandate.

Abbie · speaking

I execute only the Abbi Actions that Abbiamo.ai publishes and your company enables.▍

[Let's talk about your operations →](https://abbiamo.ai/en/contact) [See the mandate](https://abbiamo.ai/en/solutions/security#mandato)

01Bounded mandate

## Defined once, restricted anywhere, never expanded.

An Abbi Action is a named operation that, given the same inputs, produces the same result and leaves a record. Abbiamo.ai defines it with its maximum limits; each following level can only keep it the same or make it narrower.

1. «Actions» console · Abbiamo.ai
   
   ### What exists and how far it goes
   
   Inputs and outputs, connector with encrypted credentials, validations, behavior on error, maximum limits, maximum autonomy, version and audit.
2. Console 1 · Entity
   
   ### The autonomy ceiling
   
   Set by the service owner. In Caddie it is fixed: he prepares, he does not execute.
3. Console 2 · Training
   
   ### What is enabled
   
   Which «Actions», when, and with equal or lower autonomy and limits.
4. Console 3 · Deployment
   
   ### In what context
   
   The deployment's own inputs, channel, hours and limits.
5. Console 4 · Evaluation
   
   ### Nothing changes on its own
   
   It reads the log and proposes adjustments; a person approves them.
6. Effective permission
   
   ### The minimum of all
   
   If the «Action» allows 50,000, the profile 20,000 and the deployment 10,000, the commitment is 10,000. One parameter, one owner.
   
   [Meet Abbi Studio →](https://abbiamo.ai/en/abbi-studio)

02Verifiable actions

## What is said is what gets saved.

- Mode
  
  ### Prepare
  
  Assembles the validated operation without writing to business systems. It is Caddie's mode, and Abbie's when she only suggests.
- Mode
  
  ### Execute
  
  Writes to the system and returns a verifiable output. An «Action» that only executes cannot be enabled in Caddie.
- Mode
  
  ### Read-only
  
  Queries and calculations, such as a balance or an installment, do not write in any mode.
- Contract
  
  ### Contract sheet
  
  Every «Action» has its acceptance test: what is said matches what is saved, and prepare mode does not write.
- Versions
  
  ### Pinned version
  
  Each profile is pinned to a version. If the «Action» contract changes, the profile that adopts it is revalidated.
- Autonomy
  
  ### Action by action
  
  Suggests, executes with confirmation or executes on its own: it is decided for each «Action», not for the whole agent.
  
  [Explore the actions →](https://abbiamo.ai/en/abbi-actions)

03Conversation locks

## What no process can relax.

- Lock
  
  ### Hiding that it is AI
  
  Abbie identifies herself as artificial intelligence and never poses as a human.
- Lock
  
  ### Stating without a source
  
  Nothing that is not in an authorized, current source.
- Lock
  
  ### Making up conditions
  
  No prices, balances, rates, deadlines or offers, and no new policies.
- Lock
  
  ### Asking for credentials
  
  Never passwords, PINs, CVVs or tokens.
- Lock
  
  ### Applying pressure
  
  No contacts outside permitted hours, no pressure, no threats.
- Lock
  
  ### Learning on her own
  
  She improves only when a person approves a learning.

These rules are set in the entity, and no client, deployment or configuration level can relax them.

04Data

## At any level, the same rules for your data.

- Commitment
  
  ### Minimization
  
  Only the data the process needs is requested and used.
- Commitment
  
  ### Encryption
  
  In transit and at rest; connector credentials are encrypted and never displayed.
- Commitment
  
  ### Retention and deletion
  
  Configurable by the client; 180 days by default.
- Commitment
  
  ### One environment per client
  
  In production, each client has its own «tenant».
- Commitment
  
  ### Full isolation
  
  The universal knowledge base, each client's knowledge base and its transactional databases are isolated from one another. No client's data is visible to another.
- Commitment
  
  ### No training for others
  
  A client's data does not train models for anyone else or improve someone else's product without their explicit authorization.

Where your data lives is decided with the sovereignty level: abbiamo.ai/soluciones/soberania-de-datos.

05Access and change control

## Every change has a name, a date and an approval.

- Access
  
  ### One user per person
  
  Each person signs in to Abbi Studio with their own user; accounts are not shared, because every change is recorded under the name of whoever made it.
- Cascade
  
  ### No one relaxes what is above
  
  Configuration flows down from the entity to the deployment, and no lower level can relax what the level above sets.
- Learning
  
  ### Improves only with approval
  
  Every learning moves from proposed to approved or discarded by a person with permission on the corresponding console.
- Versions
  
  ### Automatic history
  
  Date, author and diff of every change, with controlled A/B tests.
- Alerts
  
  ### From the first violation
  
  A single violation of a rule is enough to trigger an alert, as is a drift in tone, a complaint or an «Action» error.
- Human review
  
  ### A sample scored by people
  
  At least 2% of conversations, with a minimum of 50 per week, prioritizing escalations and alerts.

Abbi Studio design requirements. The scope of each implementation is confirmed in its contract.

06Shared responsibility

## What Abbiamo.ai protects and what your company controls.

Responsibility is shared and explicit: each party knows its part from the design stage.

Abbiamo.ai protects

The entity, the Abbi Studio consoles, the action layer, the encryption of connector credentials, the separation per client and the decision log. It retains the transcripts and the action logs.

Your company controls

Audio recording, the telephony and infrastructure it provides, the authorized sources, the mandate and each person's permissions.

Defined jointly

The sovereignty level, retention, who audits and how the right to erasure is exercised.

Standards we follow

ISO/IEC 42001, the NIST framework, the EU AI Act as a reference, PCI DSS, HIPAA and each country's data protection law.

The exact division is set in the contract of each implementation.

07Keep exploring

## Security, standards and data.

- AI strategy
  
  ### The why comes first
  
  The belief, the six hows with their proof, what we sell and how to start with a first flow.
  
  [See the strategy →](https://abbiamo.ai/en/solutions/ai-strategy)
- Regulation and compliance
  
  ### Built for those who are held accountable
  
  The standards we follow from the design stage, those of each industry and the decisions that always belong to your institution.
  
  [See the standards →](https://abbiamo.ai/en/solutions/compliance)
- Data sovereignty
  
  ### Your data, where your case requires
  
  Four deployment levels, from the cloud to your premises, and five questions to choose.
  
  [See the levels →](https://abbiamo.ai/en/solutions/data-sovereignty)

![](https://abbiamo.ai/hs-fs/hubfs/raw_assets/public/ABBIAMO/images/abbie-retrato.jpg?width=88&height=88&name=abbie-retrato.jpg)

## Let's review the security of your first flow.

Your request goes to the partner assigned to your company.

[Let's talk about your operations →](https://abbiamo.ai/en/contact)

or write to us at [hola@abbiamo.ai](mailto:hola@abbiamo.ai)

[![Abbiamo.ai](https://abbiamo.ai/hs-fs/hubfs/Abbiamo.ai/brand/logo/abbiamo-ai-logo-480.webp?width=150&height=24&name=abbiamo-ai-logo-480.webp)](https://abbiamo.ai/)

Governed artificial intelligence, with judgment and under control.

- <https://www.linkedin.com/company/abbiamoai>
- <https://www.youtube.com/@abbiamoai>
- <https://www.instagram.com/abbiamoai>
- <https://www.facebook.com/profile.php?id=61595290656253>

Company

- [About us](https://abbiamo.ai/en/about-us)
- [Blog](https://abbiamo.ai/blog)
- [Pricing](https://abbiamo.ai/en/pricing)
- [FAQ](https://abbiamo.ai/en/faq)
- [Use cases](https://abbiamo.ai/en/use-cases)
- [Contact](https://abbiamo.ai/en/contact)

Legal

- [Legal information](https://abbiamo.ai/en/legal)
- [Privacy notice](https://abbiamo.ai/en/privacy-notice)
- [Terms and conditions](https://abbiamo.ai/en/terms-and-conditions)
- [Cookie policy](https://abbiamo.ai/en/cookie-policy)
- [Responsible use of AI](https://abbiamo.ai/en/responsible-use-of-ai)
- [Roles and responsibilities](https://abbiamo.ai/en/roles-and-responsibilities)
- [Privacy by design](https://abbiamo.ai/en/privacy-by-design)

Contact

- Contact[hello@abbiamo.ai](mailto:hello@abbiamo.ai)
- Partners[partner@abbiamo.ai](mailto:partner@abbiamo.ai)
- Legal and privacy[legal@abbiamo.ai](mailto:legal@abbiamo.ai)
- Information[info@abbiamo.ai](mailto:info@abbiamo.ai)
- Billing[facturacion@abbiamo.ai](mailto:facturacion@abbiamo.ai)
- Press and social media[social@abbiamo.ai](mailto:social@abbiamo.ai)

OfficePH Financial Park, Piso 34, Oficina 3404, Costa del Este, Panamá

© 2026 ABBIAMO TECNOLOGÍA, S.A. (Abbitec). Abbiamo.ai is a brand of ABBIAMO TECNOLOGÍA, S.A. All rights reserved.

```json
{
  "@context" : "https://schema.org",
  "@id" : "https://abbiamo.ai/#organization",
  "@type" : "Organization",
  "description" : "Abbiamo.ai diseña agentes de IA empresarial —agentes EIA— que responden solo con lo que pueden respaldar y actúan en los sistemas de cada empresa dentro de un mandato que la empresa define, siguiendo ISO/IEC 42001.",
  "email" : "info@abbiamo.ai",
  "knowsAbout" : [ "agentes de IA empresarial", "IA gobernada", "gobernanza de la IA", "ISO/IEC 42001", "NIST AI RMF", "Ley de IA de la UE", "soberanía de datos", "cobranza con IA", "IA para contact center" ],
  "logo" : "https://52100143.fs1.hubspotusercontent-na1.net/hubfs/52100143/Abbiamo.ai/brand/logo/abbiamo-ai-logo-480.webp",
  "name" : "Abbiamo.ai",
  "parentOrganization" : {
    "@type" : "Organization",
    "name" : "Abbitec (Abbiamo Tecnología)"
  },
  "sameAs" : [ "https://www.linkedin.com/company/abbiamoai", "https://www.youtube.com/@abbiamoai", "https://www.instagram.com/abbiamoai", "https://www.facebook.com/profile.php?id=61595290656253" ],
  "slogan" : "IA que rinde cuentas.",
  "url" : "https://abbiamo.ai/"
}
```