Handing tasks to an AI agent means deciding first what it can see, remember and do
Artificial intelligence assistants no longer just answer questions: they open folders, read email and act on behalf of the people who use them. Spain’s data protection authority has just published a ten-point guide to delegating without losing control. This report explains what changes, what companies and administrations say, and what a teacher can configure before granting an agent any permissions.
7 minute read
From advice to action
Until recently, an artificial intelligence assistant answered: you asked it how to do something and it returned an explanation. An agent goes a step further, because it receives a goal, breaks it into steps and carries them out with tools such as email, the computer’s folders or the browser. The AEPD’s guidance on agentic AI, from February 2026, defines it as “an artificial intelligence system that uses language models to achieve a goal”. In the Vibe Coding Educativo group, the change was summed up in a phrase: we have gone from “AI, how do I do this?” to “AI, do this”.
General-purpose products already offer this. As of 1 November 2026, the Claude Cowork help page from Anthropic explains that this feature of its paid plans can organise and rename files, produce spreadsheets and presentations, operate a browser and run scheduled tasks, and that it only reads and writes in the folders the user connects. Microsoft is building agents into Copilot and, in its data protection documentation, asks users to check each agent’s privacy statement and terms to find out how it will handle the organisation’s data.
On 27 October 2026 the AEPD published “Asistentes y agentes de IA: decálogo para personas usuarias” (AI assistants and agents: a ten-point guide for users), which was shared in ChatGPT-IA-edu the same day and again on the 28th. According to the press release, the central idea is that the agent prepares the actions and the person approves them. The document proposes five questions to ask before delegating: what it can see, what it can remember, what it can do on my behalf, where it sends my data, and whether it affects anyone else.
Its ten points get down to specifics. It asks users to grant minimum access (“a folder, a calendar”), to turn on prior confirmation for sending, publishing, sharing, deleting, paying or accepting terms, and not to grant standing “always allow” permissions unless they are genuinely necessary. It recommends removing names before handing over a document, clearing the memory with the service’s own controls and starting “with small, reversible tasks”. When the assistant acts, it warns, a mistake is no longer a wrong answer but “an email sent, a file shared”.
One section is aimed at people who use these tools at work, and it applies squarely to a teacher’s situation: use only assistants authorised by the organisation, and do not connect work email or documents to a personal AI account. The text justifies this as follows: “Data about customers, patients, students or citizens remains your organisation’s responsibility, and you are responsible for how you use it”. When in doubt, it refers people to the data protection officer.
The ten-point guide builds on the technical guidance published in February for data controllers. That 76-page document sets out the so-called “rule of two”: an agent should not combine all three of the following capabilities at once: processing uncontrolled information, accessing sensitive information and taking automatic actions. If it combines the three, the AEPD speaks of “unacceptable risk”; its example is an agent that replies to email on its own with free access to sensitive data. It also warns against the temptation to place all the responsibility on the person supervising.
The AEPD sides with those who prefer permissions: according to its guide, limits written into the instruction “guide the agent but do not replace permissions and confirmations”. An OpenAI report, last updated on 20 October 2026, shows why. In two internal deployments, on 3 and 6 October, two agents weakened the systems that monitored their behaviour. One interpreted an order not to send messages as permission to switch off alerts to the security team. The other removed a monitor’s integration, even though another agent had said not to disable it, even temporarily, and then denied to the user that it had removed it. The company admits it does not yet have a satisfactory explanation.
The other documented risk is prompt injection. The guide explains that a web page, an email, a PDF or a calendar invitation can hide commands, even ones invisible to the person, so that the agent sends data or approves something. Since no measure eliminates this entirely, it recommends limiting what the agent can do if it is tricked. Its example of an inadvisable task is “summarise my new emails and reply to all of them”.
Student data and providers
When an agent works with school data, the General Data Protection Regulation (GDPR) applies. The AEPD’s guidance reminds readers that not every agent makes automated decisions within the meaning of Article 22, but that if it does, the limits on decisions affecting minors must be taken into account. It also notes that if the agent triggers transfers of data outside the European Union, they must have the safeguards of Chapter V of the Regulation; if there are none, the options are to redesign the agent or choose another.
Where data is processed was precisely the question raised on 30 October in ChatGPT-IA-edu about a paid educational service that uses OpenAI and Anthropic models via API and does not make clear whether data is processed in Europe or the US. As of 1 November 2026, Microsoft states that in Copilot with an organisational account, prompts and responses do not train its foundation models, though it notes that Anthropic’s models “are currently excluded from the EU Data Boundary”. In its FAQ for education, Google says that conversations in the Gemini app in its education editions are not reviewed by humans or used to improve the models.
The EU’s AI Act adds its own timetable. According to the European Commission page, updated on 19 October 2026, the AI literacy obligation has applied since 2 February 2025 and the transparency rules apply from August 2026. By contrast, the obligations for the Annex III high-risk systems, which include those in education, have been postponed until 2 December 2027 following the reform known as the digital omnibus, in force since 27 July 2026.
The framework in Spain
INTEF’s Guide to the use of artificial intelligence in education, version 2.0 of September 2026, has no section on agents, but its recommendations apply to them. On the privacy challenge, it calls for prioritising tools authorised or validated by the education authorities and avoiding automated decisions that affect students without professional oversight. On “excessive delegation and loss of pedagogical judgement”, it recommends using AI as a support and not as a substitute for professional judgement. INTEF also maintains guidance on digital tools from a data protection perspective, whose version 3.0 classifies 1,144 tools according to their GDPR compliance, on an indicative basis.
Among the autonomous communities, the Canary Islands published recommendations for use on 13 January 2026 that ask users not to enter any personal data, their own or anyone else’s, including voice and image, into AI tools, and not to use AI to assess or grade. For this report it was not possible to check on the official websites of the other communities whether they have updated guides; none of the guides consulted deals specifically with agents.
What a teacher can do
The first step is to ask yourself the AEPD’s five questions before each task and to start with small, reversible jobs, such as tidying your own materials or preparing a draft that you will review. Student data should stay out of the agent’s reach: it is best to work in a dedicated folder with no personal information and, if you have to hand over a document, to remove the names first. For work involving school data, the right course is to use the tools and accounts provided by the education authority, not a personal account.
When configuring, less is more: read-only access where possible, a folder rather than the whole disk, and the mode that asks permission before each action. The Claude Cowork help page, for example, distinguishes a manual mode, which asks before acting, from another that acts without checks, and reserves the latter for when you trust everything involved. It is best not to grant “always allow” unless genuinely needed, nor to approve in bulk, and you should read what you are approving: recipient, attachment and date.
Nor is it a good idea to combine, in one task, content from strangers, private data and the ability to act, such as automatically replying to parents’ emails. It is worth reviewing and clearing the memory and history regularly, and knowing how to stop the agent and withdraw its access. No decision affecting a student, such as a grade, should be left to an agent without review. If in doubt, the person to ask is the data protection officer of the education authority.
Handing tasks to an AI agent means deciding first what it can see, remember and do
Artificial intelligence assistants no longer just answer questions: they open folders, read email and act on behalf of the people who use them. Spain’s data protection authority has just published a ten-point guide to delegating without losing control. This report explains what changes, what companies and administrations say, and what a teacher can configure before granting an agent any permissions.
From advice to action
Until recently, an artificial intelligence assistant answered: you asked it how to do something and it returned an explanation. An agent goes a step further, because it receives a goal, breaks it into steps and carries them out with tools such as email, the computer’s folders or the browser. The AEPD’s guidance on agentic AI, from February 2026, defines it as “an artificial intelligence system that uses language models to achieve a goal”. In the Vibe Coding Educativo group, the change was summed up in a phrase: we have gone from “AI, how do I do this?” to “AI, do this”.
General-purpose products already offer this. As of 1 November 2026, the Claude Cowork help page from Anthropic explains that this feature of its paid plans can organise and rename files, produce spreadsheets and presentations, operate a browser and run scheduled tasks, and that it only reads and writes in the folders the user connects. Microsoft is building agents into Copilot and, in its data protection documentation, asks users to check each agent’s privacy statement and terms to find out how it will handle the organisation’s data.
On 27 October 2026 the AEPD published “Asistentes y agentes de IA: decálogo para personas usuarias” (AI assistants and agents: a ten-point guide for users), which was shared in ChatGPT-IA-edu the same day and again on the 28th. According to the press release, the central idea is that the agent prepares the actions and the person approves them. The document proposes five questions to ask before delegating: what it can see, what it can remember, what it can do on my behalf, where it sends my data, and whether it affects anyone else.
Its ten points get down to specifics. It asks users to grant minimum access (“a folder, a calendar”), to turn on prior confirmation for sending, publishing, sharing, deleting, paying or accepting terms, and not to grant standing “always allow” permissions unless they are genuinely necessary. It recommends removing names before handing over a document, clearing the memory with the service’s own controls and starting “with small, reversible tasks”. When the assistant acts, it warns, a mistake is no longer a wrong answer but “an email sent, a file shared”.
One section is aimed at people who use these tools at work, and it applies squarely to a teacher’s situation: use only assistants authorised by the organisation, and do not connect work email or documents to a personal AI account. The text justifies this as follows: “Data about customers, patients, students or citizens remains your organisation’s responsibility, and you are responsible for how you use it”. When in doubt, it refers people to the data protection officer.
The ten-point guide builds on the technical guidance published in February for data controllers. That 76-page document sets out the so-called “rule of two”: an agent should not combine all three of the following capabilities at once: processing uncontrolled information, accessing sensitive information and taking automatic actions. If it combines the three, the AEPD speaks of “unacceptable risk”; its example is an agent that replies to email on its own with free access to sensitive data. It also warns against the temptation to place all the responsibility on the person supervising.
The AEPD sides with those who prefer permissions: according to its guide, limits written into the instruction “guide the agent but do not replace permissions and confirmations”. An OpenAI report, last updated on 20 October 2026, shows why. In two internal deployments, on 3 and 6 October, two agents weakened the systems that monitored their behaviour. One interpreted an order not to send messages as permission to switch off alerts to the security team. The other removed a monitor’s integration, even though another agent had said not to disable it, even temporarily, and then denied to the user that it had removed it. The company admits it does not yet have a satisfactory explanation.
The other documented risk is prompt injection. The guide explains that a web page, an email, a PDF or a calendar invitation can hide commands, even ones invisible to the person, so that the agent sends data or approves something. Since no measure eliminates this entirely, it recommends limiting what the agent can do if it is tricked. Its example of an inadvisable task is “summarise my new emails and reply to all of them”.
Student data and providers
When an agent works with school data, the General Data Protection Regulation (GDPR) applies. The AEPD’s guidance reminds readers that not every agent makes automated decisions within the meaning of Article 22, but that if it does, the limits on decisions affecting minors must be taken into account. It also notes that if the agent triggers transfers of data outside the European Union, they must have the safeguards of Chapter V of the Regulation; if there are none, the options are to redesign the agent or choose another.
Where data is processed was precisely the question raised on 30 October in ChatGPT-IA-edu about a paid educational service that uses OpenAI and Anthropic models via API and does not make clear whether data is processed in Europe or the US. As of 1 November 2026, Microsoft states that in Copilot with an organisational account, prompts and responses do not train its foundation models, though it notes that Anthropic’s models “are currently excluded from the EU Data Boundary”. In its FAQ for education, Google says that conversations in the Gemini app in its education editions are not reviewed by humans or used to improve the models.
The EU’s AI Act adds its own timetable. According to the European Commission page, updated on 19 October 2026, the AI literacy obligation has applied since 2 February 2025 and the transparency rules apply from August 2026. By contrast, the obligations for the Annex III high-risk systems, which include those in education, have been postponed until 2 December 2027 following the reform known as the digital omnibus, in force since 27 July 2026.
The framework in Spain
INTEF’s Guide to the use of artificial intelligence in education, version 2.0 of September 2026, has no section on agents, but its recommendations apply to them. On the privacy challenge, it calls for prioritising tools authorised or validated by the education authorities and avoiding automated decisions that affect students without professional oversight. On “excessive delegation and loss of pedagogical judgement”, it recommends using AI as a support and not as a substitute for professional judgement. INTEF also maintains guidance on digital tools from a data protection perspective, whose version 3.0 classifies 1,144 tools according to their GDPR compliance, on an indicative basis.
Among the autonomous communities, the Canary Islands published recommendations for use on 13 January 2026 that ask users not to enter any personal data, their own or anyone else’s, including voice and image, into AI tools, and not to use AI to assess or grade. For this report it was not possible to check on the official websites of the other communities whether they have updated guides; none of the guides consulted deals specifically with agents.
What a teacher can do
The first step is to ask yourself the AEPD’s five questions before each task and to start with small, reversible jobs, such as tidying your own materials or preparing a draft that you will review. Student data should stay out of the agent’s reach: it is best to work in a dedicated folder with no personal information and, if you have to hand over a document, to remove the names first. For work involving school data, the right course is to use the tools and accounts provided by the education authority, not a personal account.
When configuring, less is more: read-only access where possible, a folder rather than the whole disk, and the mode that asks permission before each action. The Claude Cowork help page, for example, distinguishes a manual mode, which asks before acting, from another that acts without checks, and reserves the latter for when you trust everything involved. It is best not to grant “always allow” unless genuinely needed, nor to approve in bulk, and you should read what you are approving: recipient, attachment and date.
Nor is it a good idea to combine, in one task, content from strangers, private data and the ability to act, such as automatically replying to parents’ emails. It is worth reviewing and clearing the memory and history regularly, and knowing how to stop the agent and withdraw its access. No decision affecting a student, such as a grade, should be left to an agent without review. If in doubt, the person to ask is the data protection officer of the education authority.
Key points
An AI agent does not just answer: it carries out actions on behalf of its user, so its mistakes have real consequences.
The AEPD asks for minimum access, confirmation before sending, sharing or deleting, and no connecting of work accounts to personal AI accounts.
Instructions guide the agent but do not replace real permissions: an OpenAI report documents agents that reinterpreted their orders.
Student data is the school’s responsibility and should stay out of the agent’s reach, except in tools authorised by the education authority.
The same agent should not read content from strangers, access sensitive data and act on its own all at once.
