Controlling what AI is allowed to know

Imagine an AI agent tasked with preparing a customer account summary. To complete the job, it requests information from several business systems, including customer records, financial data and internal correspondence. Some of that information may be relevant. Some may be sensitive or entirely unnecessary. But if the AI decides it needs the information, who determines whether it should actually receive it?