Offering · AI security and governance evidence

Give every agent its own identity, permissions and oversight.

Each agent gets a registered identity, an approved purpose, defined permissions and a monitored record of what it does. Data classifications inform the controls enforced on each mapped and tested path, and you get an evidence pack ready for your risk team, auditors and examiners to review.

Request a working sessionWhat you get

Call when

  • Risk, audit, a customer or an examiner asks for evidence you cannot yet produce.
  • Agents are about to act on sensitive data.
  • No one can say which agents exist or what they can reach.

You get

  • An inventory of every agent, with its owner, risk tier, scope of authority and reporting line.
  • An identity, role and manager for every agent.
  • Data labels enforced on every path you map and test, with the propagation lag measured.
  • Agent activity reaching your security operations center.
  • An evidence pack mapped to the obligations that apply to you.

How it runs

Length
Scoped to the agents and data in the first workflow.
You bring
Your security lead, risk and compliance owners, and an inventory of the AI tools in use.
It ends with your decision
Accept the controls for release, fix the named gaps, or stop.
Fee
Fixed fee per phase, stated in a written proposal before you commit.

The shift

Policies written for people do not automatically constrain an agent.

Agents can act faster and at greater scale than human workflows, so access limits must be enforced in systems rather than left to training or policy.

The constraint has to travel with the data and the identity, in a form the controls on each mapped path can read, rather than living in a policy document someone was meant to read.

The employee lifecycle is a useful starting pattern, but it is not the whole control model. An agent carries no human accountability, can be steered by the content it reads, and may act under delegated or its own workload credentials. It therefore needs its own delegation rules, credentials, monitoring and tests.

Weak classification can affect both what an agent sees and what it is allowed to do. That turns a data problem into an operational risk.

Agent identity and supervision

Register, credential, supervise, review and offboard every agent.

HiringRegistered with a named business owner, a purpose and an approved scope before it gets any accessAgent record and approval
CredentialsIts own identity in the enterprise identity provider; short-lived tokens; no shared or embedded keysIdentity record and token policy
RoleRole-based entitlements and a short list of tools. Acting for a person, it gets only what both of them are allowedEntitlement review and refusal tests
ManagerThe business owner supervises, and consequential actions need a person’s approvalApproval records
Code of conductVersioned policy and instructions, with tested refusalsPolicy version and evaluation results
MonitoringEvery action logged with its identity and the data labels it touched, and streamed to the security operations centerTraces and alerts
Access reviewsRoles, tools and data scope recertified on a scheduleReview sign-off
SuspensionOne switch disables the identity and its sessions; tokens are short-lived, and continuous access evaluation revokes them early where supportedA tested kill switch
OffboardingIdentity, credentials, endpoints and stored memory removed at retirementRetirement record

The analogy has limits. An agent has no judgment of its own and can be steered by text hidden in what it reads, so it gets less standing access than an employee would, and closer monitoring.

Want this mapped to your own agents and controls? Request a working session

Labels and tags

How a label becomes enforcement.

  1. DiscoverFind sensitive data across tables and documents.
  2. ClassifyOne vocabulary for both, applied continuously.
  3. TagSensitivity, tenant and purpose, attached to the data.
  4. EnforceMasking and row access, retrieval filters, API and tool rules, data loss prevention.
  5. ReconcileDetect drift between the policy source and each enforcement point.
  6. EvidenceRecord what was allowed, masked or denied, and why.

Where a DSPM tool fits

A data security posture management tool discovers and classifies sensitive data, and feeds that context to the controls that already govern each surface. It informs enforcement. It does not replace it, and it should not become a second, competing control.

One owner per control

No component should silently recreate another’s decision. Each control has one system of record, an explicit enforcement point, a way to propagate policy, and a tested failure behavior.

Human identityEnterprise identity providerWarehouse, API gateway, source systemsDeny access
Agent delegationWorkload identity and agent runtimeAgent runtime, API boundary, each toolDeny the tool call
ClassificationDSPM tool and the tagging workflowPlatform policies and retrieval filtersRedact, quarantine or deny
Entitlement and purposeEnterprise authorization policyStorage, source service, API and tool boundaryDeny by default
Approval stateWorkflow and change systemProvisioning and command workflowDo not provision or execute
Audit evidenceCentral observability and audit storeEvery request and actionAlert, retain, investigate

The observability control plane

Every agent action reaches the security operations center.

  1. ActThe agent calls a tool under its own identity, for a named user.
  2. TraceIdentity, user, tool, data labels and policy decision, under one request ID.
  3. DetectThe SIEM applies agent-specific detections.
  4. RespondA playbook suspends the identity, revokes tokens and opens an incident.
  5. ReviewThe owner decides, and the evidence joins the release record.

What the SOC watches for

Repeated denied requests outside the assigned book of business, data labeled restricted, cross-tenant attempts, tools outside the approved list, and unusual volume or hours.

Signs of manipulation

Instructions hidden in retrieved documents, repeated refusals, and requests that try to widen the agent’s authority.

Proof the response works

A tested kill switch, revocation that reaches indexes and caches within a stated window, and evidence preserved for review.

AI-specific exposures

Six exposures traditional controls were not built to see.

Exposure to models

Which data each AI system can reach, including tools staff adopt on their own.

Hidden instructions

Text in a retrieved document that tries to redirect the agent. Tools enforce authority, not the model.

Tenant mixing

A tenant label drives row access, so one client’s data never reaches another’s answer.

Revocation lag

Access removed at 9 a.m. must also leave indexes, caches and stored conversations.

Token handling

Never forward a user’s token. Each hop gets a narrowly scoped token of its own.

Memory

What an agent remembers carries an owner, a classification and a retention rule.

Reference points: NYDFS Part 500 and its 2024 AI letter, the interagency information security guidelines for banks, state insurance data security laws based on the NAIC model, the 2023 interagency third-party guidance, OWASP’s Top 10 lists for LLM and agentic applications and NIST’s generative AI profile; DORA for firms in the EU.

Read next:

Data security posture management

Discovery finds the data. Owners and controls decide its use.

A DSPM tool observes the estate: where sensitive and regulated data sits, which copies exist, who can reach them and what has drifted. It supplies protection context; it does not decide permitted use. Catalogs, owners, policy services and runtime controls turn that context into enforceable use, and the evidence returns to the owner.

1Data estateStructuredWarehouses, lakes, databasesUnstructuredFiles, email, case notesApplications and SaaSSystems of record, APIsDerived copiesExports, caches, indexes, logs2DSPMDiscoverAssets, copies, ownersClassifySensitive, regulated contentAdd contextIdentity, exposure, accessPrioritize and proposeRisk paths, remediation3Governed intentCatalog and semanticsOwner, meaning, lineageDecision and policyPermitted use, retentionGovernance as codeVersion, test, reconcile4EnforcementAt sourceGrants, row and column rulesIn pipelinesMinimize, tokenize, quarantineAt retrievalIdentity, tenant, purposeAt tool and outputScopes, DLP, memory controls5 Use and evidenceRAGAgentsAnalyticsMLDev and testData sharingEvidence loop: discovered state, accepted decision, deployed control, tested behavior; drift and incidents return to the owner.
DSPM connects data discovery to governed AI use. Swipe sideways to see the whole drawing.

Every copy

Authorization must reach every served copy.

An answer can come from the source, a retrieval index, a cache or an agent’s memory. Each copy must enforce the same rights, and a revocation must reach all of them within a measured, approved window.

SourceAuthoritative contentand access rightsRetrieval indexChunks, metadata andenforced filtersCache and memoryStored excerpts andprior responsesAnswer or actionOnly the currentlyauthorized scopeSource changes and revocation propagate within a measured windowDerive scope from verified identity. Revalidate or invalidate old permissions before reusing stored content.
Authorization must reach every served copy. Swipe sideways to see the whole drawing.

Next step

Bring the question your risk or audit team keeps asking.

A free sixty-minute session with Richard to examine one workflow, what is blocking it and whether there is a useful next step.

Request a working session