ANSWER
AI agent in production: what does Brazil's LGPD require?
Reviewed .
When an AI agent processes personal data, controller and processor roles depend on who determines purposes and essential elements and who acts under documented instructions. The concrete allocation follows the actual activities. At minimum, define a legal basis, execution-time records, least-privilege access, immediate interruption, retention, subprocessors and contractual responsibilities, with legal review when risk requires it.
Step by step
- Document the legal basis for each processing activity.
- Require execution-time action records.
- Limit credentials to least privilege and review them.
- Make immediate interruption available to operators.
- Formalize purpose, subprocessors, retention, incidents and data return.
How an agent does this
AgenticosCore may act as processor when handling data under documented client instructions and acts as controller for its own website contact data. Roles depend on actual activities and are recorded in the contract/DPA. Trail, House Rules and Brake provide operational evidence and control.
Frequently asked questions
Are model guardrails enough?
No. Guardrails protect conversation; governance protects execution. Auditors need evidence of the action, credential and applied rule.
Who is accountable if the agent fails?
Accountability depends on each party's actual role and conduct. The contract and operational evidence clarify instructions and control but do not replace case-specific legal review.