By default, a new agent requires sign-in with a company account in Microsoft Entra ID. However, the person building the agent can choose the no-sign-in option. Then anyone with the link can talk to the agent and ask about the documents connected to it.
These risks are limited with data protection policies in the Power Platform admin center. Microsoft’s documentation calls them data policies, and previously DLP policies (data loss prevention). They let you block publication without sign-in, selected knowledge sources and selected channels.
A separate decision concerns AI models. In Copilot Studio you can choose Anthropic models (Claude), but in the EU they are switched off by default. Once enabled, data is processed outside Microsoft’s EU Data Boundary, so it is worth making this decision together with your data protection officer.