Agents make all-or-nothing access untenable
The internal data that would make an agent genuinely useful (contracts, customer records, clinical notes, financials, support history) is exactly the data nobody wants to grant broad access to. Traditional access control decides who can reach a resource. It cannot decide what an agent may do once it gets there.
- An agent that can read a table can also summarize, combine, and export it.
- Permission granted for one task persists for every subsequent one.
- Row-level rules cannot see whether a generated answer reveals too much.
- Routing every agent action through manual approval defeats the point of the agent.
Authorize the output, not just the request
Because the Escrow Agent runs the computation, it sees the result before the requester does, so it can evaluate what is about to be released, not merely who asked.
Rules as programs
Express controls as sophisticated as the use case demands, rather than forcing every policy into a role or a row filter.
Data-aware decisions
Is the result aggregated enough? Does it expose a small group? Does it combine sources in a prohibited way? Checked per request.
Human in, on, or out
Keep people in the critical path, let them supervise, or delegate routine decisions entirely per policy, not per system, request, or user.
Useful agents and a defensible record
- Agents that can work against real internal data instead of a sanitized subset.
- Scattered rules from contracts, policies, and licenses distilled into controls that are actually enforced.
- Auditable evidence of what each agent requested, what ran, and what it received.
- No copy of sensitive data sitting in a vendor’s environment.
If your data is shared across platforms, programmable authorization for shared data covers how this layers onto an existing governed-sharing setup.