Review emails with sensitive data to external addresses

Covers: GDPR / UK GDPR, arts. 5(1)(f) and 32

Use in VulnifyOpens in monitor mode by default. Nothing is created until you click Apply.

What it does

Emails an agent sends to an external address that are flagged as containing sensitive data need approval before they go out. The flag can come from the resource classification or from sensitive data Vulnify detects in the email content (for example CPF numbers or email addresses).

Notes

Matching depends on your resource labels and on Vulnify’s content checks for common identifiers (such as CPF numbers or email addresses); it is not a complete detector of personal or sensitive data. Test in monitor mode first.

Default mode in this template: ENFORCE. The “Use in Vulnify” link preselects monitor mode; you can switch to enforce before applying.

Policy

Policy JSON (API)

{
  "name": "gdpr-review-sensitive-data-email",
  "description": "Emails an agent sends to an external address that are flagged as containing sensitive data need approval before they go out. The flag can come from the resource classification or from sensitive data Vulnify detects in the email content (for example CPF numbers or email addresses).",
  "enabled": true,
  "action": "ANY",
  "condition": {
    "action": "SEND_EMAIL",
    "destination": "EXTERNAL",
    "containsSensitiveData": true
  },
  "decision": "REVIEW",
  "mode": "ENFORCE"
}

Policy YAML (CLI policy file)

apiVersion: vulnify.io/v1
kind: Policy
metadata:
  name: gdpr-review-sensitive-data-email
spec:
  description: "Emails an agent sends to an external address that are flagged as containing sensitive data need approval before they go out. The flag can come from the resource classification or from sensitive data Vulnify detects in the email content (for example CPF numbers or email addresses)."
  enabled: true
  action: ANY
  condition:
    action: SEND_EMAIL
    destination: EXTERNAL
    containsSensitiveData: true
  decision: REVIEW
  mode: ENFORCE

Example test cases

Case	Input	Expected decision
sensitive email to external address	`{"agent":"example-agent","action":"SEND_EMAIL","resource":"support-inbox","destination":"EXTERNAL_EMAIL","containsSensitiveData":true}`	REVIEW

Try this template on your own agents, in monitor mode first.

Use in Vulnify

Not legal advice. These templates are starting points to help you design internal controls for AI agents. They are not legal advice and do not make your organization compliant with LGPD, GDPR, HIPAA or any other law or regulation. Review them with your own legal and compliance team before relying on them. Templates are provided “as is”, without warranty. Whether a rule matches depends on how you classify your resources and on the data your agents send; test in monitor mode before enforcing.

License: the templates are dedicated to the public domain under CC0 1.0. “Vulnify” is a trademark; the CC0 dedication does not cover the Vulnify name or logo.