AI agent governance must be enforced at the data layer, EDB says

The report poses a central question: when an agent tries to complete an action it was never authorized to do, what actually stops it? Since agents run on enterprise models and touch enterprise data, responsibility for their actions sits with the organization. That responsibility cannot be met in hindsight or through abstract policies, the report argues.

EDB illustrates the need for context-aware rules with a simple example: "Never open the car door." Followed literally, an agent could never get in or out of a car. But in a crash with fire and injury, the desired rule is the opposite. Context in the moment is everything, so agents need intelligent rules that account for it.

Controls layered above the model, such as instructions and monitoring, have a structural limit, the report says. They rely on predictable output, but autonomy makes output unpredictable. Governance that reviews an action before it happens cannot keep pace with a system acting in milliseconds across many systems.

Instead, governance must become executable and enforced at the data layer, where agents query, retrieve, transform, and act on data. A policy denying access to certain data is meaningful only if the system can deny that request at the moment it happens. Similarly, auditability requires reconstructing which agent acted, what data it touched, which user it acted for, and what resulted. When governance lives at the data layer, it holds regardless of how the agent is built or behaves.

Agent behavior may be probabilistic, but governance cannot be. The enterprise should not rely on a model choosing to follow policy; the system must enforce it. The difference is between hoping an actor stays in bounds and constructing bounds it cannot cross.

EDB says the controls needed are already familiar at the data layer, including role- and attribute-based access, row- and column-level security, classification and masking, policy as code, and complete audit trails. What changes is that agents must be recognized as principals in their own right, with their own identity and a declared purpose when a session opens. Once purpose is bound to identity, the policy engine can evaluate it like role or department, and audit logs can capture not just who acted and what they touched, but also what they declared they were there to do.

The report details nine controls grouped under three imperatives: enforce it, see it and prove it, and unify and harden. Enforcement controls include query-time access control for agents and users, dynamic column masking driven by the same policy path, and agent identity as a first-class principal with declared purpose bound at session start and the acting user preserved. Visibility and proof include classification and tagging driving policy, session-level audit logging recording which agent acted for which user and under what purpose, and lineage across pipelines so results can be traced back to the requesting action. Unification and hardening include centralized portable policy management, encryption at rest and in transit, and consistent enforcement across on-prem, cloud, and sovereign or air-gapped environments.

Priyanka Jain, VP of product management for data & AI governance at EDB, said: "Declared purpose is what makes the difference. It becomes an attribute the access layer already understands, evaluated in the same policy path as role and row-level security. The enforcement mechanism does not change. What changes is that the agent's purpose is part of what it evaluates, and part of what the record proves afterward."

EDB concludes that regardless of where an organization is in its AI adoption journey, enforcement at the data layer allows it to move faster rather than slower, since the controls are already in the database.