The AI Governed Layer
AI agents are becoming ordinary consumers of enterprise data. That creates a problem the usual answers do not solve.
The mismatch
An agent asked a simple question — "how many customers do we have?", "does this person appear anywhere else?" — has to reach across systems that disagree about who exists. Three plausible approaches each fail:
| Approach | Why it fails |
|---|---|
| Query the sources directly | The agent inherits the duplication. Three records for one person become three customers in its answer. |
| Copy data into a retrieval index | The copy has no permissions. Whatever it holds, everyone asking gets. |
| Per-application access control | Every application re-implements the rules, and they drift. The agent's reach becomes the union of everyone's mistakes. |
The common failure is that identity and governance are left behind at the point the data is copied or federated.
The principles
One canonical entity, not federated copies. Resolution happens once, in one place. Every consumer — including the agent — sees the same governed record.
Identity is the control plane. The agent acts as the signed-in user, carrying that user's identity to every request. There is no service account and no broker credential. An agent's reach is exactly its operator's reach.
A dedicated, low-latency surface for AI. Agents get a purpose-built endpoint exposing governed operations, rather than being pointed at a general API and trusted to behave.
Governed, audited, and explainable by construction. Every agent action passes the same four enforcement layers and lands in the same append-only audit log, attributed to the user whose identity was used.
What this means concretely
- Granting someone access to the assistant grants no data access. Their existing permissions already decided that.
- A field masked for a user is masked in the agent's context too. The agent
receives
[MASKED]and can only repeat it — it has nothing to reconstruct from. - An agent operating for a read-only user cannot write, in any autonomy mode. Autonomy governs whether a person is asked; it never governs what the request is permitted to do.
- Every agent action is auditable, attributed, and reversible on the same terms as any other action.
Why it has to be architectural
A policy saying "the assistant should respect permissions" is only as good as each code path that remembers it. Here the property falls out of the design: masking is applied when the response is generated, so there is no unmasked surface for the AI layer to read from. It is not that the agent is trusted not to look — there is nothing to look at.
Next
Last verified against commit 952ed91b (2026-08-03)