Agent access in data rooms: what to demand before you connect an assistant

Whatever your policy says, someone on the deal is pasting extracts into a chat assistant to summarise them. That path has no gating, no watermark, no revocation and no record. Judged against that reality, a permissioned endpoint inside the room is a tightening of control, not a loosening of it.

Read only by default. An agent token should not be able to move, delete or share documents unless a human deliberately raises its scope for a specific task.

One action revocation. You should be able to kill agent access from the same screen you use to revoke a viewer, and see the attempt fail immediately.

One audit trail. Agent calls must land in the same log as human views, naming the token, the document and the time. Two separate logs mean nobody will reconcile them when it matters.

Across the platforms in our index, only a small minority document anything resembling an MCP endpoint, and most of the enterprise rooms describe AI features that run inside the vendor's own interface rather than exposing an interface your tools can call. That is a defensible position, but it is a different product from agent access.

If a vendor claims agent support, ask them to revoke a token in front of you and then show you the failed call in the log. The demo takes two minutes and settles the question.