# Isolate agentic AI from personal data

Practice ID: 38
Topic: `ai` (AI: Boundaries that keep AI useful without surrendering sensitive context, memory, or system access.)
Added: 2026-09-01
Journey entry point: `optimize` (Improve ownership, resilience, privacy, portability, and maintenance across the chosen system.)
Start with: `technical` (technical)
Supports: `privacy-clarity` (privacy clarity; group: `digital-control` / My data and digital setup), `visible-ai-boundaries` (AI with visible, owned boundaries; group: `ai-boundaries` / My use of AI)

## Pattern

An agent able to use tools or act on a system should not share an environment with sensitive personal applications and data by default.

## Practice

Run agentic AI in a separate machine, account, virtual environment, or tightly scoped workspace that cannot reach personal data it does not need.

## Start small

Check what one agent can read or execute and remove one permission it does not need.

## Watch out

Sandboxing reduces risk but is not a guarantee; treat broad or unattended access as a meaningful attack surface.

## Continue

- [See more in AI.](https://live.freewith.tech/?topic=ai#practices)
- [Journey](https://live.freewith.tech/journey.md)
- [Concepts](https://live.freewith.tech/concepts.md)
- [Complete agent-readable database](https://live.freewith.tech/llms.txt)