Requests rarely arrive in the language the process expects
When people inquire about their data, they express their requests in their own words, for example, by saying "Send me everything you have", "Why are you still emailing me?", or "Delete my account". These are different requests, and the third is often not exactly what the person intends.
The process begins with interpreting the scope, and that is where most delays occur. Getting this wrong in either direction is a problem. If the scope is too narrow, the response is incomplete. If it is too broad, more information is disclosed than was requested.
Identity checking comes before any other step and is not merely an administrative procedure. If you respond to a request from someone impersonating the subject, that is a disclosure, not a customer service success.
All later decisions about what is within scope, what is exempt, and what involves other people are legal judgments. The agent assembles and flags them. The data protection lead then decides.
How the agent is built in Agent Studio
The system prompt sets the limits: interpret the request, gather the relevant material, identify the categories that need review, and at no stage decide what is disclosable, exempt, or required.
Identity verification is a necessary precondition, not something the agent performs. Assembly does not start until your existing verification process is complete.
Prompt skills include your system inventory and your response templates, so the setup is based on where your data is actually stored.
The Agent Chat node takes the request text and returns a structured analysis: what is being asked, which category the request falls into, and what is ambiguous and needs clarification from the requester.
The flow searches the various systems. The agent then reviews the results, flagging any third-party data and any material your policy designates as possibly exempt, without removing them.
Everything is sent to the data protection lead. A Date node tracks the response window because the clock continues running regardless of how the assembly progresses.
The agent does not disclose, delete, or send anything.
What this agent is built from
- System prompt: interprets and assembles. Never determines what is disclosable, exempt, or required.
- Precondition: assembly begins only after your existing identity verification is complete.
- Prompt skills: hold your system inventory and response templates.
- Agent Chat (Util): returns a structured interpretation, including what needs clarifying.
- Date (Util): tracks the response window from receipt.
- Slack (Human in the Loop): delivers everything to the data protection lead for determination.
- When an ActionFlow is enough: If you have a well-mapped search across known systems, that is a workflow. Interpreting an ambiguous request is the agent.
Frequently asked questions
Start building AI workflows
Create a free account, open a template or a blank canvas, and run your first ActionFlow.
Newsletter
Get product updates
New nodes, agents, and product notes. We send mail only when we have something worth opening.