How Sublime's AI agents are secure by design

Sublime has developed two AI agents, ASA (Autonomous Security Analyst) and ADÉ (Autonomous Detection Engineer), to enhance email security by processing sensitive data and making informed decisions within a controlled environment. These agents are designed with a privacy-first approach, ensuring that customer data is not retained post-processing and that all AI features are disabled by default, requiring explicit activation by organizations. The agents operate within the Sublime platform, with strict boundaries that prevent them from accessing external systems or making irreversible changes without human oversight. ASA focuses on analyzing emails and aiding threat remediation, while ADÉ generates detection rules specific to organizational needs. Both agents provide transparent and auditable outputs, with structured reasoning and evidence that allows human analysts to review and verify their actions. Security measures are enforced at the platform level rather than relying solely on the AI agents, with multi-tenancy isolation and role-based access control ensuring robust protection against threats like prompt injection. This architecture ensures that the agents are trustworthy, operating within a fixed scope and under human supervision to mitigate risks while providing enhanced security capabilities.