SitecoreAI agents: permissions, data privacy and control. A guide for Saudi and UAE teams

When we demo Agentic studio to a bank, a ministry or a large retailer in Riyadh or Dubai, the room usually goes quiet at the same moment: when the agent writes a page and someone asks, “Who allowed it to do that?” The next two questions come from the security and legal teams. Where does our content go when the agent reads it? And can our developers build their own agents, under our rules?

This guide answers them from Sitecore’s documentation, release notes and contract terms as they stand on 4 November 2026, then maps the answers to the rules that apply in Saudi Arabia and the UAE. Where Sitecore’s documents are silent, we say so, because those are the points to settle with Sitecore in writing before you sign.

What you are actually governing

SitecoreAI launched globally on 10 November 2025 as the evolution of XM Cloud, and existing XM Cloud customers were upgraded automatically. Its AI work happens in Sitecore Studio, which has four parts: Agentic studio, App studio, Marketplace and Sitecore Connect. For governance, the parts that matter are the ones that can read or change your content.

For a plain introduction to agents, flows and spaces, start with our Agentic studio explainer. This guide picks up where it ends: who can do what, and what happens to your data.

Permissions: the four layers

SitecoreAI has no single “AI permissions” screen. We group the controls into four layers. The first three are documented for agents. The fourth is documented for people, and whether it also limits in-product agents is not (see below).

Check two settings in layer 2 first. On the Settings page, all tools are enabled by default, and the tools page lists the Context tool as off. That means chats and agents can create, read, update and delete content items, create pages and add components, upload and update assets, change personalization and revert jobs, unless an Admin turns those tools off. And since February 2026, Admins can make each agent private, public, or shared with named users. An agent that a marketer built for one campaign does not need to be visible to the whole organization.

Who does the agent act as?

The answer depends on how the agent gets in.

The Agent API row is the one to plan around. An automation client is an environment-level credential that only Organization Admins or Owners can create, so anything that holds its secret acts with the reach of that client, whoever is typing the prompt. Treat it like a service account in your core systems: one client per integration, stored in a vault, rotated, and owned by a named person. Tokens last 24 hours, which limits the damage from a leaked token, but Sitecore’s reference gives no expiry for the client secret, so treat it as valid until you revoke it.

For the last row, test it yourself before you rely on it. Give a pilot user an author role that cannot edit one section of the site, then ask an agent, under that user, to change a page in that section. What happens tells you whether your content security reaches the agent. Then put the same question to Sitecore and ask for the answer in writing.

Human approval: where it is built in, and where you add it

Since July 2026, when someone asks Chat to create, update or translate content, SitecoreAI shows the tools it used and a review card of the changes it proposes. The reviewer can compare current and proposed values, edit a suggestion, skip individual changes or decline the whole request. Sitecore says you review and approve the proposed changes “before anything is saved.”

That covers free-form prompts in Chat. For everything else, approval is something you design in.

• Flows include human checkpoints for review or approval “when needed”, and running flows show which steps require confirmation. The prebuilt flows come with checkpoints where Sitecore judged them needed. In a custom flow, a step you leave out is a step that does not happen.
• Agent API calls are tracked as jobs, and the Jobs endpoints let you view and revert an operation by its job ID. That is a recovery tool. It does not stop the change happening in the first place.
• Previews. The Virtual Filesystem adds an explicit commit step and checks permissions before changes reach real data, and the Sitecore Context tool can give each agent off, read or write access. Both were in Preview when announced in May 2026.
• Publishing. Approving a change on the review card saves it. Whether it then reaches the live site depends on your workflow and publishing setup, and Sitecore does not document a review card for workflow agents or Agent API calls. If AI-written content can reach a published state without passing a workflow state that a person owns, fix the workflow before you scale the agents.

Our rule for clients in regulated sectors is that an agent can draft, translate and suggest, and a named person approves anything that a customer will read. For a bank or an insurer that includes rates, fees, product terms and anything that sounds like advice.

Audit: what is recorded, and the gap to close

Agentic studio keeps operational records: execution reports with runtime, resource use and the artifacts produced, a Jobs monitor on the Settings page, job tracking in the Agent API, and confidence scores and source references on generated artifacts, with version history.

The Sitecore Common Audit Log is a different thing. It records who did what, with IP address, browser and time, keeps entries for one year, and can stream them to your SIEM through a webhook. Today its list of covered products is CDP, Connect, Personalize and the Cloud Portal. SitecoreAI and Agentic studio are not on it.

So if your auditors or your regulator will ask “which agent changed this page, who started it and who approved it”, plan to assemble that answer from three places: Agentic studio job records, your content workflow history, and your own log of Agent API calls at the integration layer. Decide the retention period now, because investigations often need records from long before the incident, and a webhook cannot send events from before it was set up.

Data privacy: what Sitecore commits to

The answers that count are in the contract, so this section quotes the legal documents.

One line in Sitecore’s developer FAQ says SitecoreAI “does not share customer data with external providers or use it to train external AI models.” Read that alongside the legal terms, which say a third-party model provider acts as a subprocessor and may hold data temporarily. Your data reaches the provider to be processed, and the provider may not use it for its own purposes. Your DPO should work from the contract.

Where the data lives, and where the AI runs

The Sitecore DPA (version 5.2, June 2026) says Sitecore will store Customer Data “only in the selected region unless notified otherwise.” It also says those residency terms are subject to the Gen AI Addendum. Paragraph 2(e) of the Gen AI Addendum then lets Sitecore and its approved subprocessors process Gen AI inputs and outputs “in locations determined by the applicable Gen AI Functionality, AI model, and deployment type”, including “outside the Customer selected data centre location”, with transfer safeguards where the DPA calls for them. The data covered includes prompts, completions, embeddings, images, metadata and augmented prompt context, which is the content retrieved from your site to ground a prompt.

So your stored content stays in your region, but the text sent to the model, including content pulled from your site, may be processed elsewhere.

On 24 February 2026, Sitecore announced dedicated SitecoreAI deployments for the region, running on Microsoft Azure. For Saudi Arabia, it announced plans to start delivery from the Eastern Province in Q4 2026, describing an in-country path for “running cloud and AI workloads locally”. For the UAE, it announced a sovereign deployment planned for later in the year. Microsoft has said customers can run workloads from its Saudi Arabia East region from Q4 2026. As of 4 November we have not seen Sitecore announce that either deployment is generally available. Neither announcement says whether model inference for Agentic studio and Chat will run in-country, and the Gen AI Addendum still permits processing elsewhere.

That is the point to get in writing. A Saudi tenant whose content is stored in the Eastern Province, but whose prompts are processed outside the Kingdom, has in-country storage and out-of-country AI processing. For many marketing sites that is acceptable. For a government entity or a regulated institution it may not be.

Saudi Arabia: the rules this touches

• PDPL. The Personal Data Protection Law has been fully enforceable by SDAIA since 14 September 2024. Personal data that agents read, such as names in forms, audience data or customer stories, falls under it, and so does any transfer of that data outside the Kingdom.
• Draft amendments to the PDPL Implementing Regulations. SDAIA published draft amendments for public consultation, which ran from 6 October to 5 November 2026. As reported by Clyde & Co, the draft would add an express requirement (draft Article 23) to store personal data inside the Kingdom, while still allowing transfers under the PDPL. It would also require breach notice to SDAIA within 72 hours regardless of harm, make registration mandatory for controllers transferring data abroad, and add DPIAs for emerging technologies and automated decisions. It is a draft and not in force. If adopted, it takes effect 60 days after publication in the Official Gazette, and the AI processing question above becomes far more important.
• NCA controls. The Essential Cybersecurity Controls (ECC-2:2024) and the Cloud Cybersecurity Controls (CCC-2:2024) apply to government entities and operators of critical national infrastructure, and others are encouraged to adopt them. CCC-2:2024 also binds cloud providers that serve those tenants, so ask Sitecore for its CCC-2:2024 position for the Saudi deployment. CCC-2:2024 removed the old in-Kingdom hosting controls and handed data localization to the National Data Management Office at SDAIA, so localization now has to be checked against NDMO and PDPL rules.
• SDAIA AI guidance. The AI Ethics Principles and the generative AI guidelines for government and for the public are guidance, and they are not binding law. In our experience, procurement teams in government entities use them as a checklist, especially on transparency and human oversight.

UAE: the rules this touches

• Federal PDPL. Federal Decree-Law No. 45 of 2021 is in force, but its executive regulations had still not been issued as of March 2026, and enforcement has been limited. Plan to the law as written. The federal law does not apply in the DIFC or ADGM, which have their own data protection laws, and transfers between the mainland and those free zones count as cross-border.
• DIFC. Regulation 10 of the DIFC Data Protection Regulations, under DIFC Data Protection Law No. 5 of 2020, covers personal data processed by autonomous and semi-autonomous systems. It requires notice at first use and, for high-risk processing, measures such as an Autonomous Systems Officer. A DIFC-based bank or insurer using agents on personal data should map its agent setup to it. The DIFC consulted on amendments in June and July 2026, so check the final text.
• ADGM. The ADGM Data Protection Regulations 2021 apply in Abu Dhabi Global Market, with breach notification within 72 hours and fines of up to USD 28 million.
• UAE AI Charter. The UAE Charter for the Development and Use of AI sets 12 principles, including data privacy, transparency and human oversight. It is a statement of principles, and in our experience government buyers quote it in tenders.

We are not lawyers, and this guide is not legal advice. It is the list we work through with a client’s legal and security teams before the first agent goes live.

Can developers build their own agents?

Yes, and there are four ways, which suit different teams.

Each route needs its own review. A custom agent inside Agentic studio is governed by the layers above. A connector adds a data source, so it needs the same review as any new integration: what it can read, what it can write, and who signed in to it. An outside agent using the Agent API is, in effect, a new system with write access to your website, and should go through your change and security process like one.

Arabic and English: one more control

Bilingual sites add a risk that English-only sites do not have. An agent can produce an Arabic page that reads well and says something slightly different from the English one, and the reviewer who approves the English may not read the Arabic closely. The review card shows proposed translations like any other change, so the control has to come from how you organize approvals. Route Arabic changes to an Arabic-speaking approver. Keep regulated wording, such as product terms or official names, in items that agents can read but whose write access is locked by security or workflow, and confirm with the permissions test above that agents cannot change them.

For how Arabic content is modelled in Sitecore in the first place, see our Arabic Sitecore guide and our piece on Arabic-first Sitecore builds.

A starting configuration we recommend

1. Keep Organization Owners and Admins to a short named list. They hold the top role in every app, so each one is a full-access account.
2. Assign Builder licences to the few people who will design agents, and review the list every quarter.
3. On the Settings page, turn off every tool your first use cases do not need. Tools switch on and off as a whole, and the Content tool brings delete along with create and update, so rely on the review card and your workflow for the rest.
4. Set every new custom agent to private, and share it with named users once it has been tested.
5. Use one automation client per Agent API integration, store the secret in a vault, rotate it, and log every call at your integration layer.
6. Put an approval step in every flow that ends in content a customer can see, and keep publishing behind a workflow state that a person owns.
7. Route Arabic changes to an Arabic-speaking approver.
8. Write down what must never be entered into prompts, such as personal data you do not need, health data, card data, national ID, Iqama and Emirates ID numbers, and anything classified.
9. Decide where your audit trail will come from, and how long you keep it, before the first agent goes live.
10. Run the permissions test described above, and keep the result with your risk register.

Questions to put to Sitecore before you sign

1. For a tenant hosted in Saudi Arabia or the UAE, where will model processing for Agentic studio, Chat and the Marketer MCP server run, and with which provider?
2. How long do model providers keep prompts and outputs, and how long does Agentic studio keep chats, spaces and artifacts?
3. Do in-product agents act within the item-level permissions of the person who runs them?
4. Which content counts as “augmented prompt context”, and is it sent to the model on every Chat request?
5. When will SitecoreAI and Agentic studio events appear in the Common Audit Log?
6. Which features in our order are in Preview or Early Access, and what does that mean for support?
7. What is the current subprocessor list for Gen AI, and how will we be told about changes? The DPA gives 30 business days to object to a new subprocessor.

If you are comparing partners as well as platforms, our Sitecore partner RFP checklist covers the delivery side.

Our view

SitecoreAI gives you more control over agents than most buyers expect: role layers, a Builder licence, per-agent visibility, a review card on AI-proposed changes, approval steps in flows and the ability to revert API jobs. Sitecore has also put its training and data-use commitments into the contract, which is where they belong.

Two things are still yours to close. The AI processing location is not tied to your hosting region, and the audit trail for agent actions has to be assembled. Configure carefully, start with low-risk use cases such as drafts, summaries and translation suggestions, and widen what agents can do once your approvals and logging have proved themselves.

Frequently asked questions

What data privacy protections apply to AI agents in SitecoreAI?

Sitecore says it does not use prompts or results to train models, and contractually restricts its third-party AI providers, described as OpenAI/Azure, from using them for training. Prompts and outputs count as your Customer Data. A model provider acts as a subprocessor under the DPA and may keep data temporarily. Stored content stays in your chosen region unless Sitecore notifies you otherwise, but the Gen AI Addendum allows AI processing outside it.

How does SitecoreAI manage role-based access for AI agent actions?

Arcsen groups the controls into four layers: Cloud Portal organization roles (Owner, Admin, User), Agentic studio roles (User, Editor) plus a Builder licence for creating agents, brand kit and brand context access, and the content security roles and workflows inherited from XM Cloud. Admins can also turn tools off and make each agent private, public or shared with named users. Sitecore does not document whether content security limits in-product agents, so test it.

Does SitecoreAI support custom agent workflows built by developers?

Yes. Developers can build standard and workflow agents in Agentic studio with custom skills, schemas and templates, add custom MCP connectors, build outside agents on the Agent API or the Marketer MCP server, and build Marketplace apps with the Marketplace SDK. Creating agents needs a Builder licence.

Can a SitecoreAI agent publish content without approval?

It depends on the route. AI-proposed changes from Chat are not saved until a person approves them on the review card. Flows include human checkpoints where needed, and in custom flows you add them. Sitecore documents no review card for workflow agents or Agent API calls, so keep a workflow state that a person owns between AI-written content and the live site.

Is SitecoreAI hosted in Saudi Arabia?

Sitecore announced in February 2026 that it plans to deliver SitecoreAI from the Eastern Province of Saudi Arabia starting in Q4 2026, on Microsoft Azure, and a sovereign deployment in the UAE later in 2026. As of 4 November 2026 we had not seen either announced as generally available.

Does Saudi PDPL allow SitecoreAI to process data outside the Kingdom?

The PDPL allows transfers outside the Kingdom under its transfer rules. SDAIA’s draft amendments to the PDPL Implementing Regulations, whose consultation ran from 6 October to 5 November 2026, propose an express requirement to store personal data in the Kingdom. Ask Sitecore where AI processing runs for your tenant, and have your legal team assess it against the PDPL.

Is there an audit log for SitecoreAI agent actions?

Agentic studio keeps execution reports, a Jobs monitor and Agent API job records. The Sitecore Common Audit Log does not yet list SitecoreAI or Agentic studio, so a full audit trail has to be assembled from these records, your workflow history and your own integration logs.

Sources

• Sitecore Developers: SitecoreAI FAQ
• Sitecore Docs: Sitecore Studio overview
• Sitecore Docs: Working with Agentic studio
• Sitecore Docs: Understanding agents
• Sitecore Docs: Understanding flows
• Sitecore Docs: Marketer MCP and Agent API overview
• Sitecore API docs: Agent API reference
• Sitecore Docs: Sitecore Marketer MCP server
• Sitecore changelog: Strengthening Agentic studio with configuration, collaboration, and control (27 Feb 2026)
• Sitecore changelog: More customizable agents, spaces, and content workflows (30 Mar 2026)
• Sitecore changelog: Custom MCP connectors, faster workflows, and a more polished chat (15 May 2026)
• Sitecore changelog: Agent API v2.0 release and endpoint updates (18 May 2026)
• Sitecore changelog: Stay in control of AI-proposed changes in SitecoreAI (3 Jul 2026)
• Sitecore changelog: Create brand context for AI agents (31 Aug 2026)
• Sitecore Docs: Cloud Portal roles
• Sitecore Docs: Agentic studio, manage users
• Sitecore Docs: Agentic studio settings
• Sitecore Docs: Tools available to chats and agents
• Sitecore Docs: Manage brand kit access
• Sitecore Docs: The security roles
• Sitecore Docs: Sitecore Common Audit Log
• Sitecore Legal: Gen AI FAQs
• Sitecore Legal: Master Subscription Terms, Gen AI Addendum
• Sitecore Legal: Data Processing Addendum (v5.2, June 2026)
• Sitecore Docs: SitecoreAI data privacy
• Sitecore: ISO/IEC 42001 certification (19 Aug 2026)
• Sitecore: Dedicated deployments of SitecoreAI in Saudi Arabia and the UAE (24 Feb 2026)
• Microsoft: Saudi Arabia datacenter region available from Q4 2026 (10 Feb 2026)
• IAPP: Saudi PDPL’s first anniversary (26 Sep 2025)
• Clyde & Co: SDAIA publishes draft amendments to the PDPL (8 Oct 2026)
• National Cybersecurity Authority: Essential Cybersecurity Controls (ECC-2:2024)
• National Cybersecurity Authority: Cloud Cybersecurity Controls (CCC-2:2024)
• Chambers: Data Protection & Privacy 2026, UAE
• Mayer Brown: AI regulation in the DIFC, Regulation 10 (Jan 2026)
• Sitecore Legal: Gen AI Activation Form
• Sitecore: Security posture for regulated industries (7 Apr 2025)
• DataGuidance: SDAIA publishes guidelines on generative AI
• Al Tamimi & Co: The UAE’s federal data protection law
• Sitecore Docs: Add a custom connector to your MCP server
• Sitecore changelog: New features and improvements in Agentic studio (8 Jan 2026)
• UAE Government: The UAE Charter for the Development and Use of Artificial Intelligence