When Agents Act on Their Own, Governance Has to Live in the Data Layer

As enterprises deploy AI agents with increasing autonomy—the ability to plan, decide, and act across systems without human approval for each step—architects face a fundamental question about enforcement: when an agent attempts an action it was never authorized to perform, what actually prevents it?

What Happened

According to security practitioners advising enterprise deployments, the instinct to add guardrails above the model layer—instructions, policies, and monitoring stacked on top of agents—is reaching its structural limits. The argument is that controls at the agent level depend on predictable output from systems designed for autonomous action. EDB's VP of product management for data and AI governance, Priyanka Jain, frames it this way: policy has to be enforced by the system, not relied upon as a choice the model makes. The alternative is constructing bounds agents cannot cross to begin with.

Why It Matters

For developers building agent systems and enterprises deploying them at scale, the distinction between agent-level controls and data-layer enforcement carries significant practical weight. Role- and attribute-based access control, row- and column-level security, classification and masking, policy-as-code, and complete audit trails already exist in many enterprise databases. The proposed shift is not to new mechanisms but to recognizing agents as principals with their own identities—requiring declared purpose at session start, preserving the acting user's identity, and evaluating that purpose through the same policy path used for role or department access checks today. For teams shipping autonomous systems into regulated environments, this represents a governance architecture decision with downstream implications for compliance, auditability, and operational risk.

The Bottom Line

The article outlines nine controls organized under three imperatives—enforce it, see it and prove it, unify and harden—that practitioners argue are necessary when agents operate as first-class principals in enterprise data environments. Jain describes declared purpose as the key differentiator: an attribute evaluated in the same policy path as existing role-based controls, becoming part of both real-time enforcement and post-hoc audit records.