You decide what an agent may see and touch, and what it may not.
Encapsulation limits the damage if something goes wrong: public and internal material sit in separate folders or repositories, and an agent only gets the access it needs. The other half is the check, which finds errors before they go live. Encapsulation prevents, checks detect.
Example from Module 2
One folder for what may become public, another for customer data. Internal material never sits in the public folder.
Module 2: “Protecting data: encapsulate and check”. In the Werkbank course room, with sign-in.