When Agents Act on Their Own, Governance Must Live in the Data Layer
Max Romanenko, EDB
5:01 am, PT, August 27, 2026
Presented by EDB
As enterprises grant AI agents increasing autonomy—the ability to plan, decide, and act across systems without human approval for every step—a critical question arises: When an agent attempts an unauthorized action, what prevents it?
These agents operate within your models, interacting with your data in your infrastructure, and the responsibility for their actions rests with you. This responsibility cannot be addressed retrospectively or through abstract policies that exist only on paper. Agents require rules applicable to the immediate context because they lack independent judgment.
Consider a seemingly simple rule: Never open the car door. Literally followed, an agent could never enter or exit a vehicle. However, if we change the context (e.g., a crash scenario where someone is trapped and needs to escape), the desired rule shifts. Context in the moment is paramount. We expect agents to perform intelligent tasks, which necessitates intelligent rules.
The natural inclination is to add safeguards around the agent: instructions, policies, and monitoring layered above the model. While these mechanisms are important, they share a fundamental limitation: The car-door rule remains plausible until the precise moment you must decide whether to open the door. Controls at the agent level are only as reliable as the agent’s output is predictable, which autonomy makes unpredictable. Governance relying on pre-action reviews cannot keep pace with systems acting in milliseconds across numerous interconnected systems.
Governance needs to become:
- Executable: Enforced where agents actually work—at the operational data layer.
- Enforced at the Moment of Action: Rules applied immediately and contextually as actions occur.
The data layer serves as the enforcement point for governance. Agents create value by interacting with data: querying, retrieving, transforming, and acting upon it. A policy restricting access to certain data classes is meaningful only if the system can deny that access at the moment the agent requests it. Similarly, a principle demanding AI auditability is meaningful only if organizations can reconstruct agent actions, including:
- Data accessed
- Transformations applied
- User identity
- Resulting outcomes
When governance resides at the data layer, it persists regardless of how the agent was built or its eventual behavior because control emanates from the database itself, not dependent on agent promises.
Agent behavior may be probabilistic. Governance cannot rely on hoping agents follow policy; policies must be enforced by the system. This is the distinction between expecting adherence to boundaries and establishing boundaries that cannot be crossed.
The controls enabling this shift are already employed by many enterprises at the data layer:
- Role- and Attribute-Based Access Control
- Row- and Column-Level Security
- Classification and Masking
- Policy as Code
- Complete Audit Trails
What agents change is not the control mechanisms but who those mechanisms must recognize. Identity management treats agents as principals with their own identities and purposes declared at session inception. Once purpose is linked to identity, the policy engine evaluates it akin to roles or departments, and audit logs capture:
- Agent actions
- Data accessed
- Declared purpose
This translates into nine controls, grouped under three imperatives:
- Identify Agents: Define agent identities and purposes.
- Enforce Access Control: Utilize role-based access control mechanisms to restrict data access.
- Log All Interactions: Maintain comprehensive audit trails of agent actions and data accessed.
