An employee may have access to thousands of documents they have never opened. Give an AI assistant the same access and those documents can be searched, correlated and summarized in seconds.
Nothing changed in the permissions. What changed is what can be done with them. An agent can pull information from several systems, combine it into a working context, generate new information, and take unintended actions that create material risk.
That helps explain one of the more important findings from our AI Cybersecurity and Resilience Study, executed in partnership with Qualitate. Sensitive data exposure was the most frequently cited internal AI security concern, named by 15 of the 25 enterprise security, IT and technology leaders we interviewed.
In the agentic era, data governance has to account for more than access. Organizations need to understand what information AI can bring together, how that information can be used, where it can persist or travel, which actions can follow and whether the organization can reconstruct what happened afterward.
This article is part of a series exploring how AI governance changes established security and resilience domains. Here we focus on data and a fundamental shift in the control problem: authorized access no longer tells us enough about risk. As AI gains greater ability to find, combine, use and act on enterprise information, data governance has to extend across access, context, use, action and reconstruction.
ACCESS: Know What AI Can Reach
AI discovery and visibility emerged as one of the more mature capabilities in our study. Fourteen of 25 respondents reported implementation for selected use cases or broad implementation and regular testing, with another eight reporting partial implementation.
The next step is connecting that visibility to data reach. An inventory of AI applications and agents should show the data sources they can access, including the permissions inherited from users, service accounts, and connected systems. That view can expose dormant entitlements that become more consequential when AI can search and use information across structured and unstructured data at machine speed. The result gives security and data teams a more useful basis for tightening access before AI puts it to work.
CONTEXT: Understand What AI Brings Together
The next problem appears when AI starts assembling context.
Retrieval-augmented generation (RAG), model context, agent memory, tool use, and multi-agent workflows allow information from different systems to come together during a single task. Data that was separated by application boundaries can now meet inside an inference chain.
Take an account-planning agent. It retrieves customer information from a CRM system, contract terms from a document repository, and internal pricing information from a knowledge base. Each source has its own permissions and controls. The agent can bring information from all three into the same working context. That combination matters because the sensitivity of the context may exceed the sensitivity of any individual piece of information.
It also complicates lineage. Security teams need to understand which information entered the workflow, where it came from, which model or agent consumed it, what transformations occurred, which tools received it and where the resulting information went. Traditional lineage tells an organization where data originated and how it moved through established systems. AI governance also needs visibility into how information was assembled and transformed during inference.
USE: Govern Purpose, Persistence and Output
Once information enters an AI workflow, access control gives only part of the answer. The account-planning agent may have legitimate access to the customer record, contract, and pricing strategy. That does not settle whether all three belong in the same context for a particular task.
Suppose the agent passes that context to a second agent tasked with drafting a customer communication. The underlying access checks can all succeed while confidential pricing strategy makes its way into a customer-facing draft.
The policy question is whether that information should be used for that purpose, in that context. Data classification, business purpose, task, application, model and destination can all shape the answer. Retrieval policies can limit what enters the workflow in the first place, while persistence controls can prevent information appropriate for one task from remaining in agent memory or moving to a downstream tool, second agent, or later interaction.
Controls also need to follow data through the output. Information appropriate for an internal AI workflow may become inappropriate when it appears in a customer response, passes to another application or agent, or leaves the enterprise. Output filtering and DLP controls can enforce those boundaries before information moves beyond its intended use.
ACTION: Let the Data Shape the Guardrails
Once an agent can act, the sensitivity of the data it is using should help determine the boundaries of execution.
An agent working with public product information may operate within relatively broad limits. The acceptable scope should narrow when dealing with regulated customer data, confidential financial information or sensitive intellectual property. Write access, external communication, tool invocation, and autonomous execution furthermore require tighter controls.
Scale changes the risk as well. Reading one customer record and processing 100,000 records create different levels of exposure even when the underlying data classification is identical.
Classification has historically helped determine who can see information. In an agentic environment, it can also help determine what AI may do with it.
RECONSTRUCTION: Follow the Data Through the Outcome
The final problem appears after the AI has completed the task.
Traditional logs may show that an account queried a database, called an API, or changed a record. An AI workflow can require a richer record of what happened: which information was retrieved, how it was combined, what context influenced the model or agent, what was generated, which tools were invoked and what changed downstream.
Only 8 of 25 respondents reported monitoring and reconstructing agent activity at one of the two implemented levels. Ten were at the planning stage or had not addressed it.
Reconstruction becomes especially important when every access was legitimate. Imagine that an agent retrieved authorized data, combined it in an allowed workflow, and then produced a flawed conclusion that triggered changes across several systems. A database backup can restore data. It cannot explain which information shaped the agent’s decision, which resulting changes were correct or how those changes propagated through the business process. The organization needs enough evidence to follow the data through the outcome.
That is where data governance becomes part of cyber resilience. Recovery depends on knowing which state can be trusted, and AI makes that difficult when the problem originated in how authorized information was interpreted and used.
TEST ONE DATA PATH
Organizations do not need a new data security program for every AI use case. Discovery, classification, IAM, DLP, masking, lineage, logging and backup remain useful foundations.
The practical question is whether those controls can follow data through an AI-mediated workflow.
Pick one production AI application or agent and trace a consequential task. Identify what information it can retrieve, which sources can enter the same context, what information can persist, where outputs can go and which actions can result.
Then introduce a failure. Assume the AI uses legitimate data to produce the wrong outcome.
Can the team reconstruct what it retrieved, what information influenced the result, where that result went and what changed because of it?
The first place that trail disappears is a good place to start.
The next article in this series examines the other side of the control problem: identity. Once an agent can use enterprise data to act, the question becomes how much authority should transfer from a person or business process to the agent, under which conditions and how far that authority should be allowed to travel.
