How to Prove a Copilot Studio Agent Did Not Expose Customer Information Under Reg S-P

What Reg S-P asks a firm to be able to demonstrate

As of November 2026, 17 CFR 248.30 requires every covered institution to maintain written policies and procedures covering administrative, technical and physical safeguards for customer information. Those policies must be reasonably designed to protect against unauthorized access to or use of customer information that could result in substantial harm or inconvenience to a customer. They must also include a program to detect, respond to and recover from such access, including customer notification procedures.

The response program has to assess the nature and scope of an incident and identify the customer information systems and types of customer information that may have been accessed or used without authorization. That requirement shapes the evidence. A conversation-level answer is not enough. The firm needs to attribute activity to specific systems and data types.

The 2024 final amendments reflect a presumption of notification. A firm must notify affected individuals unless a reasonable investigation determines that notice is not required. The amendments also call for written documentation of any detected unauthorized access or use and of the response to it. A no-exposure conclusion is therefore the output of an investigation, and the investigation can only be as strong as the records it draws on.

Scope matters as well. Subpart A applies to nonpublic personal information about individuals who obtain financial products or services primarily for personal, family or household purposes. It does not cover information about companies or about business, commercial or agricultural customers. Separate in-scope data from out-of-scope data before deciding which agent interactions need this level of evidence.

Where the evidence gaps usually arise

Activity records for a single interaction are often spread across the agent platform, each connector and the underlying data systems. Conversation transcripts show what was said. They do not necessarily show which tool calls ran underneath or what those calls returned. Tool and connector records may show that a call happened without linking it to the conversation that triggered it.

The larger gap is policy. Most activity records show that something occurred. They rarely show which rule applied to that interaction, which version of the rule was in force, or why the outcome was permitted. An examiner asking whether the agent was allowed to disclose a data type will want that answer, and a log of the disclosure does not supply it.

A practical test is to pick one completed interaction that involved a customer information system and try to assemble its full record from existing sources. Note every step where you must infer rather than read. Those inferences mark the places where a no-exposure conclusion would not hold up.

Why enforcement in the execution path yields stronger evidence

There are two ways to arrive at a record. One is to reconstruct events after the fact by correlating logs from several systems. The other is to enforce policy in the execution path, so that each decision on an interaction or tool call is made, and recorded, at the moment it happens. A runtime decision record can state the policy applied, the data classes involved and the decision: allow, redact, block or escalate for human approval.

This changes what the record can show. A blocked tool call is documented as blocked, with the rule that blocked it. A redacted response is documented along with what was removed. An escalation to human approval records who approved it. The record shows what the agent was permitted to do as well as what it did, which is the distinction a reasonable investigation depends on.

Trussed enforces policy in the execution path for individual interactions and tool calls, and the enforcement itself generates audit-ready evidence. Deployment is self-managed in the customer cloud, with configurable retention and data residency, which lets a firm hold the records under its own recordkeeping policy. Its scope is the individual interaction and tool call. It does not provide transaction-level governance or end-to-end tracing of agentic workflows, so a firm should plan separately for correlating decisions across a multi-step process.

The firm still has to map these records to its own Reg S-P procedures and decide what a reasonable investigation relies on. Per-interaction decision records are a stronger basis for that investigation than reconstruction, but the regulation does not prescribe them.

What a defensible record looks like in practice

A defensible no-exposure file for a given agent and period has a consistent shape. It identifies the agent and its reachable systems. It lists the interactions in scope and, for each, the requester, the systems and data types touched, the policy version applied and the decision taken. It shows the response as delivered. It documents the investigation method and the evidence relied on, and it is retained alongside the firm's written safeguards policies.

For a compliance leader, the point is not to hold more data. It is to hold records that answer the examiner's questions directly: what was the agent allowed to do, what did it do, and which customer information, if any, left the firm's control. When those answers come from records created at the moment of each decision, they are less dependent on someone's later reading of fragmented logs.