Newer tools do more than answer. They take multi-step actions on your behalf. That power is useful and it also raises the stakes.
What actually happens
An agent reading your files is sending them out
You point it at a folderand give it a task
It reads the fileswhich means uploading them to a data center
It acts for youedits, sends, runs steps
First: confirm the data agreement · scope it to one folder · no sensitive files inside
Reading a file is the same as uploading it, so before you use an agent like Claude Code, confirm the data-sharing agreement, point it at a single folder, and make sure nothing that could identify a client is in that folder.
An assistant that answers a question is different from one that acts. An agent can run a search, read the result, fill a form, browse websites, or carry out a sequence of steps, choosing its next move from what the last step returned.
The agentic tools are mostly developer software. Claude Code, OpenAI Codex, and Google’s Gemini CLI act on the files on your device from a terminal, GitHub Copilot can turn a described task into a draft, a browser agent like ChatGPT’s agent mode clicks through sites, and connectors built on the Model Context Protocol let an assistant reach a calendar or a database. At a nonprofit these are usually set up and scoped by IT.
Whether client data is safe turns on the account tier, not the brand. Free and consumer tiers often train on what you enter; only a business, enterprise, or API tier that promises in writing not to train on your inputs belongs near client information, with a signed agreement for anything health-related.
Agents help most with repetitive, multi-step admin that has a clear, checkable result: compiling a first-draft resource list from trusted sites, or filling a repetitive template from a table, always with a person checking the output.
When an agent reads a file, that is the same as uploading it to the vendor’s data center, so pointing one at a client file means that file has left your control, and the risk is higher when it acts inside a live record where a wrong step is a real action.
Before you use an agentic tool at work, confirm your organization has a data-sharing agreement with the vendor, point it at a single folder that holds nothing client-identifying, and keep a person approving every consequential step.
The nonprofits using these tools well keep a person in the loop, letting AI produce a first-draft translation or summary that staff then correct, and holding high-stakes work for a qualified person.
How it works, and where it breaks
1The model can call a tool and read what comes back
A plain chatbot only produces text. An agent is that same model connected to tools it can call, a web search, a form filler, a piece of code, and given a way to decide when to call one. The model writes a structured request, the tool runs, and the result is fed back into the model to read. Language models can be trained to decide which tool to call, when to call it, and what to pass it (Schick and colleagues, 2023). This is what lets an agent look something up, act on the answer, and keep going without you driving each click.
2It reasons, acts, reads the result, and continues
An agent works in a loop. It reasons about what to do next, takes an action, reads what that action returned, and uses it to decide the following step, repeating until it judges the task done. Interleaving reasoning with actions this way, so the model plans, calls a tool, and adjusts based on what it observes, is how these systems carry out multi-step tasks (Yao and colleagues, 2023). The loop is where the usefulness comes from and also why the path an agent takes is hard to predict in advance.
3One wrong step feeds the next
Because each step takes the previous step's output as its input, an early mistake does not stay put. It becomes the starting point for everything after it. A study of transformers on multi-step tasks found accuracy falling sharply as the number of steps grew, with errors accumulating along the chain (Dziri and colleagues, 2023). The effect shows up directly in agent tests: on a benchmark of tool-using agents, leading models finished fewer than half of the tasks, and succeeded on all eight independent attempts of the same task less than a quarter of the time (Yao and colleagues, 2024). For agency work that is why a human approves each consequential action: a wrong figure or a misread rule caught at the first step never gets the chance to drive a form submission at the fifth.
4An agent can be hijacked by the content it reads
An agent reads whatever you point it at, and it cannot reliably tell your instructions apart from text embedded in a document, an email, or a web page. That gap, called prompt injection, is ranked the top security risk for these applications, because hidden instructions in a file the agent merely opens can redirect it (OWASP, 2025). It is not theoretical. In one disclosed case a single crafted email caused a corporate AI assistant to leak internal files with no click from the user, and in another an agent deleted a live production database. The safe rule is to never give one agent private client data, exposure to untrusted content, and a way to send information out at the same time.
A set of trusted websitesA first-draft list you then verify
Compile a first-draft resource list from trusted sites
Using only the websites I list, compile a first-draft resource list for the need I name. For each entry give the organization, the service, the contact details, the source page you took it from, and the date the page was last updated if it shows one. Mark any entry where the site was unclear or where you had to guess, and do not add anything from outside the sites I gave you. [name the need and paste the trusted websites, no client identifiers]
Guardrail. An agent can misread a page or pull a stale entry, so open every source and confirm each entry before anyone relies on it. See Module 1.
A task you might hand to an agentA plan with human checkpoints marked
Set the approval points before you let an agent run
I am considering having an AI agent do the task I describe. Break the task into steps, and for each step say whether it is low-stakes enough to run on its own or whether it takes an action a person should approve first, such as sending a message, submitting a form, or changing a record. Point out where an early error would quietly carry into later steps. [describe the task and the systems it would touch]
Guardrail. Let an agent run only the low-stakes steps on its own, and keep a person approving every step that acts on a real record or sends something official. See Module 4.
A repetitive file or data choreA dry run an agent shows before it acts
Make an agent show its plan before it changes anything
Before you change anything, show me the full list of actions you plan to take and wait for my approval. Work only inside the single folder I point you to, treat it as a copy, and never touch the original files. [have IT run this on a copy of a non-sensitive folder]
Guardrail. An agent acting on files can do real damage, so run it on a copy, require the plan first, and keep the only copy of client records out of reach. See Module 4.
Worked example
One wrong entry, caught before it spread
A caseworker has an agent compile a first-draft resource list from four trusted sites, with instructions to cite the source page for each entry.
The agent returns a tidy list of a dozen organizations, each with a service, a phone number, and a link, and it reads like finished work.
Checking the sources, the caseworker finds one entry where the agent misread a page and attached the wrong eligibility rule, and two later entries that repeated that same wrong rule because the agent carried its earlier reading forward.
They correct the misread entry, fix the two that inherited it, and confirm the rest against the cited pages, keeping the agent on drafting and themselves on approving anything a client will act on.
Guardrail. Do not let an agent act on real client records or submit anything official without a person reviewing each step. See Module 1 and Module 4. Before adopting an agentic tool, run it through Choosing a tool; for a lower-risk way to reuse a setup, see Build a custom assistant.
Sources
Schick, T., Dwivedi-Yu, J., Dessi, R., Raileanu, R., Lomeli, M., Zettlemoyer, L., Cancedda, N., & Scialom, T. (2023). Toolformer: Language models can teach themselves to use tools. In Advances in Neural Information Processing Systems 36. https://arxiv.org/abs/2302.04761
Yao, S., Zhao, J., Yu, D., Du, N., Shafran, I., Narasimhan, K., & Cao, Y. (2023). ReAct: Synergizing reasoning and acting in language models. In The Eleventh International Conference on Learning Representations (ICLR). https://arxiv.org/abs/2210.03629
Dziri, N., Lu, X., Sclar, M., Li, X. L., Jiang, L., Lin, B. Y., West, P., Bhagavatula, C., Le Bras, R., Hwang, J. D., Sanyal, S., Welleck, S., Ren, X., Ettinger, A., Harchaoui, Z., & Choi, Y. (2023). Faith and fate: Limits of transformers on compositionality. In Advances in Neural Information Processing Systems 36. https://arxiv.org/abs/2305.18654
Yao, S., Shinn, N., Razavi, P., & Narasimhan, K. (2024). tau-bench: A benchmark for tool-agent-user interaction in real-world domains. arXiv. https://arxiv.org/abs/2406.12045