Stopping a CrewAI Manager Agent from Delegating Customer Data to Unauthorized Agents Under NYDFS Part 500
Treat every delegation and tool call as an authorization decision, not a prompting problem. Use CrewAI configuration (delegation settings, narrow roles, per-agent tool assignment) to shrink what can happen, then enforce policy at runtime on each interaction and tool call that may carry customer nonpublic information (NPI): allow, redact, block or escalate for human approval. Record every decision so you can show a reviewer which policy was applied and what the outcome was.
A layered control design
- 1
Layer 1: Native CrewAI configuration
Disable delegation on agents that do not need it, enable it only where a manager must route work, write narrow roles, and assign each agent only the tools its task requires. This reduces the paths NPI can take.
- 2
Layer 2: Data classification at the boundary
Define which fields count as NPI and which agents and tools are justified to receive them. This inventory is the basis for every policy rule and for the access-privilege review.
- 3
Layer 3: Runtime policy enforcement
Evaluate each interaction and tool call in the execution path. Outcomes are allow, redact, block or escalate for human approval, enforced at runtime, not reviewed after the fact.
- 4
Layer 4: Evidence
Each decision generates a durable record: the policy evaluated, the agent or tool involved, the outcome and any approver action.
Evidence to retain for each control
- Access inventory: which agents, tools and providers may receive NPI, with justification and review dates, supporting the access-privilege review.
- Policy decision records: for each delegation or tool call involving NPI, the policy evaluated, inputs classified and the decision returned.
- Redaction events: what was redacted, from which interaction, and the destination that received the redacted version.
- Blocked delegation attempts: the originating agent, intended recipient and reason, retained so they can be produced on request.
- Approver actions: the identity of the human approver, the time, the decision and any stated rationale.
- Third-party coverage: a record of external tools and model providers that receive NPI and how each is reviewed under your provider oversight policy.
How delegation exposes customer data
In a hierarchical CrewAI deployment, a manager agent breaks work into tasks and assigns them to worker agents. The task description and the context the manager composes travel with each assignment. If the manager received customer NPI, such as account details or claim and policy data, that content can be copied into the delegated task without anyone deciding that the receiving agent should see it.
The exposure does not stop at the worker. Workers call tools, and tools may reach external services or model providers. A single delegation can therefore move NPI to an agent with no business need for it, and then onward to a system outside your direct control.
This is a data-flow and authorization problem. A prompt telling the manager "do not share customer data" is an instruction to a probabilistic component, and it produces no record that a rule was applied. Static configuration helps, but it is fixed before a run and does not examine what a specific delegation contains. Neither gives you a per-interaction decision you can later demonstrate.
Mapping the exposure to Part 500
23 NYCRR Part 500, as amended by the Second Amendment and in force as of November 2026, requires a cybersecurity program that protects the confidentiality, integrity and availability of information systems and the NPI stored on them. That program must be based on the covered entity's risk assessment, so the multi-agent NPI data-flow risk belongs in that assessment.
Three requirements bear directly on delegation. First, covered entities must limit and review access privileges for users, including third-party service providers, that have access to NPI. Access privileges are addressed in Section 500.7. Part 500 does not say AI agents are users, but an agent or tool that receives NPI raises the same question: who is authorized to see this data, and why.
Second, the amended text calls for risk-based policies, procedures and controls to monitor the activity of authorized users and detect unauthorized access to, use of, or tampering with NPI. Agent-level monitoring is a reasonable way to apply that to agent activity.
Third, NYDFS industry guidance on AI-related cybersecurity risk and on third-party service provider risk says provider policies should address access controls, encryption, due diligence and contractual protections. External tools and model APIs reached through agent tool calls may fall into that relationship, so review them accordingly. Senior management owns the program and the annual compliance certification, so agent controls should produce evidence that supports it. Have counsel confirm how these provisions apply to your agent architecture.
Enforcement points and their limits
A CrewAI execution path offers three places to apply a decision: when a task is delegated, when a tool is invoked, and when content is sent to a model. Each has tradeoffs.
At delegation, you can inspect the task and context before it reaches a worker. This is the earliest point, but content may be unstructured, so detection of NPI in free text is imperfect and needs tuning for false positives and misses.
At tool invocation, arguments are more structured and the destination is known, which makes allow and block decisions easier to state precisely. The limit is that a tool call check does not see what the model does with data it already holds.
At the model call, you can redact before content leaves your boundary. Redaction can reduce the quality of the task output, so decide per field whether redaction or blocking is the right outcome.
Trussed enforces policy in the execution path at the level of individual interactions and tool calls, with allow, redact, block and escalate outcomes. It does not provide end-to-end tracing of an agentic workflow or transaction-level governance across agents, so keep your own workflow design and review practices in place for those needs. Trussed has run continuously in a regulated enterprise production environment for more than 18 months, with customers in insurance, pharma, healthcare and education. Insurance is the regulated financial sector where it is deepest.
Delegation as an authorization decision
Manager agent proposes a delegation
A task and its attached context are about to move to a worker agent.
Policy is evaluated
The destination agent, tool and data content are checked against the delegator's scope.
Decision is enforced
Allow, redact, block or escalate for human approval, before the data moves.
Evidence is recorded
The policy evaluated, the outcome and any approver action are retained.
See how enforcement evidence is produced
Trussed enforces policy on individual interactions and tool calls and produces audit-ready evidence mapped to NYDFS. Walk through how this applies to a multi-agent flow that handles customer NPI.
See How Evidence Is ProducedHow does your AI governance program compare?
See where your program has gaps in less than 2 minutes.