Getty Images/iStockphoto
How to control agentic AI access to enterprise data
AI agents stand in for users and reach multiple systems. Governing their access requires distinct identities, scoped authority and records that show who authorized each action.
Controlling access to different types of data has long been a core element of enterprise governance.
Many enterprise identity practices governing data access were built either for human users subject to regular reviews or for machines with service accounts that had relatively fixed permissions. Agentic AI doesn't neatly fit into either category. Unlike a service account with relatively fixed access, an agent can act on behalf of a user and request new tools and datasets mid-task. The challenge becomes apparent when something goes wrong. Incomplete logs make it difficult, if not impossible, to understand who authorized the agent, which resources it accessed, what actions it took and how that authority was delegated.
A 2026 Cloud Security Alliance survey sponsored by Oasis Security found that 79% of nearly 400 IT and security professionals rated their confidence as low to moderate in defending against attacks orchestrated through nonhuman identities. More than 16% said their organizations did not track the creation of new AI-related identities. A January 2026 Gartner cybersecurity report projects that by 2028, 90% of organizations that let employees share credentials with AI agents will need to make significant investments to change that practice.
Where current controls fall short
In many cases, enterprises adapt existing tools and practices for identity, credentials and monitoring to provide controls for agentic AI.
The existing approaches can include:
- Assigning an agent to an existing service account.
- Moving an API key for a service into a credential vault for agentic access.
- Extending an existing OAuth authorization flow to cover the agent.
- Using existing data loss prevention (DLP) tools and pointing them at what agents send and receive.
These implementations can leave several access and accountability gaps for the following reasons:
- Credentials get provisioned at deployment and are not reevaluated.
- Agents get standing permissions broader than the task requires.
- Logs don't identify the person who initiated and approved the action.
- Older controls were built to audit accounts and events, such as credential use and API calls. They weren't designed to track the dynamic and unpredictable behavior of agentic AI to preserve the task, agent identity, authorization decision and delegation chain behind an action.
The emerging control layer for agentic AI
There are several capabilities for governing how agents access data and establishing accountability for their actions.
Agent identity
The starting point is to give every agent in production a unique, attributable identity rather than folding it into an existing shared account.
A February 2026 concept paper from NIST offers guidance on securing AI agents using existing standards, such as OAuth 2.0/2.1, OpenID Connect, SPIFFE and SPIRE for workload identity and SCIM for lifecycle management. The paper explains how to extend protocols to track agent actions back to the person who authorized them.
Runtime authorization
Proper agentic AI security includes giving the agent only the permissions needed for a specific task, action and protected resource at the time of access. The Model Context Protocol (MCP) authorization model includes methods that support runtime authorization through incremental scope consent, allowing a server to request additional permissions as the work requires. This approach enforces least privilege by replacing a broad static permission grant with a narrower scope aligned with the task, resource and action.
Delegated authority
The principle of delegated authority states that when an agent acts on behalf of a user, it operates under the authority of that person, and that grant must be provable. In practice, the authorization record retains both the human user who authorized the action and the agent carrying it out. MCP addresses this through Enterprise-Managed Authorization extensions that use the organization's identity provider to govern agent-to-application connections. The underlying mechanism -- an IETF draft standard called the Identity Assertion JWT Authorization Grant -- uses standard token exchange to confirm the human's identity while restricting what the agent is allowed to do.
Machine-native audit
Going beyond delegation, there is also a need to establish accountability after the fact. From a practical perspective, that means providing tamper-evident records that tie each delegated agent action to the person who initiated it and the agent that performed it. Useful audit records should show what an agent was authorized to do, what actions it took and which resources it accessed or changed.
Vendor questions and priorities for IT leaders
Creating a plan to govern data access for agentic AI requires turning these capabilities into vendor requirements and implementation priorities.
Consider the following questions to ask vendors:
- Does each production agent receive its own identity, or does it operate on a shared service account?
- How does a human's identity propagate through the agent into every downstream call, and can the vendor produce a sample audit record that shows the user, agent, delegated authority and the resulting action?
- Are credentials short-lived and scoped to a task, and how quickly can a misbehaving agent be revoked?
Consider focusing on these controls first to establish accountability and limit standing access.
- Assign a named and accountable human to every production agent before it touches enterprise data.
- Replace static, long-lived credentials with short-lived tokens scoped to a single task, resource and permitted action where the architecture supports them.
- Move authorization checks to the data layer, with access evaluated when requests are made.
Data access architecture needs to assume agents will call APIs, tools and data services directly, not just through a human-driven app. Route agent queries through the same policy layer that governs human access.
Autonomous agents will keep testing enterprise data controls. Before an agent accesses production data, an organization should be able to answer who authorized the agent's access and trace the actions it took.
Sean Michael Kerner is an IT consultant, technology enthusiast and tinkerer. He has pulled Token Ring, configured NetWare and been known to compile his own Linux kernel. He consults with industry and media organizations on technology issues.
