Review agent access to sensitive (e.g. health) data

Covers: Health (LGPD art. 11, sensitive personal data)

Important: Vulnify is not designed to process protected health information (PHI) under HIPAA and does not currently sign Business Associate Agreements. Do not send PHI to Vulnify. This template evaluates action metadata, your own resource labels and optional content checks for some common identifiers; it is not a reliable detector of health data.

Use in VulnifyOpens in monitor mode by default. Nothing is created until you click Apply.

What it does

Every agent read of a resource you classify as SENSITIVE waits for approval, whether or not that particular read contains health data: the SENSITIVE classification alone is enough to match. Ships in monitor mode first: decisions are recorded but the action is allowed, so you can see volume before enforcing.

Default mode in this template: MONITOR. The “Use in Vulnify” link preselects monitor mode; you can switch to enforce before applying.

Policy

Policy JSON (API)

{
  "name": "health-review-health-data-access",
  "description": "Every agent read of a resource you classify as SENSITIVE waits for approval, whether or not that particular read contains health data: the SENSITIVE classification alone is enough to match. Ships in monitor mode first: decisions are recorded but the action is allowed, so you can see volume before enforcing.",
  "enabled": true,
  "action": "READ",
  "resource": "SENSITIVE",
  "condition": {
    "containsSensitiveData": true
  },
  "decision": "REVIEW",
  "mode": "MONITOR"
}

Policy YAML (CLI policy file)

apiVersion: vulnify.io/v1
kind: Policy
metadata:
  name: health-review-health-data-access
spec:
  description: "Every agent read of a resource you classify as SENSITIVE waits for approval, whether or not that particular read contains health data: the SENSITIVE classification alone is enough to match. Ships in monitor mode first: decisions are recorded but the action is allowed, so you can see volume before enforcing."
  enabled: true
  action: READ
  resource: SENSITIVE
  condition:
    containsSensitiveData: true
  decision: REVIEW
  mode: MONITOR

Example test cases

Case	Input	Expected decision
agent reads patient records	`{"agent":"example-agent","action":"READ_DATA","resource":"patient-records","containsSensitiveData":true,"recordsAffected":1}`	REVIEW (monitor: recorded, final ALLOW)

Try this template on your own agents, in monitor mode first.

Use in Vulnify

Not legal advice. These templates are starting points to help you design internal controls for AI agents. They are not legal advice and do not make your organization compliant with LGPD, GDPR, HIPAA or any other law or regulation. Review them with your own legal and compliance team before relying on them. Templates are provided “as is”, without warranty. Whether a rule matches depends on how you classify your resources and on the data your agents send; test in monitor mode before enforcing.

License: the templates are dedicated to the public domain under CC0 1.0. “Vulnify” is a trademark; the CC0 dedication does not cover the Vulnify name or logo.