{
  "id": 3742668,
  "title": "When agents act on their own, governance has to live in the data layer",
  "url": "https://urgent.news/2026/08/27/when-agents-act-on-their-own-governance-has-to-live-in-the-data-layer",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-27T12:01:00.000Z",
  "source": {
    "name": "VentureBeat",
    "slug": "venturebeat",
    "url": "https://venturebeat.com/security/when-agents-act-on-their-own-governance-has-to-live-in-the-data-layer"
  },
  "original_language": "en",
  "account": "Enterprise leaders must rethink how they govern artificial intelligence agents as they grant these systems greater autonomy to plan, decide, and act across systems without requiring human approval for each step. The critical question architecture teams must now answer is: When an agent attempts an action it was never authorized to perform, what actually prevents it? These AI agents, running on models, accessing data in infrastructure, are accountable for their actions. This responsibility cannot be addressed retrospectively or through abstract policies that exist on paper but fail in practice. Agents require rules applicable in the moment, as they do not independently evaluate the outcomes of their actions. Consider a simple rule: never open the car door. On the surface, an agent could never enter or exit the vehicle. However, if the context shifts (such as a car crash, a fire, or a person needing swift relief), the intended rule must be inverted. Context at the time of action is paramount. We are entrusting agents with intelligent tasks; this necessitates intelligent rules. The initial inclination is to surround the agent with guardrails—the instructions, policies, and monitoring layered atop the model. While these mechanisms are important, they possess a structural limitation: the effectiveness of the car-door rule hinges on the model's ability to make a correct decision at the decisive moment. Controls at the agent layer are only as reliable as the model's output predictability, and autonomy introduces unpredictability into the model's output. Governance that relies on pre-action evaluations cannot keep up with systems that operate in milliseconds, processing multiple systems simultaneously. Governance must become executable and enforced at the operational data layer, in the context, and precisely at the moment of execution. The data layer is the place governance must enforce Its value lies in the ability to touch data—query, retrieve, transform, and increasingly act upon it. A policy prohibiting an agent from accessing a specific data class is only meaningful if the system can deny that access instantaneously when the agent makes the request. Similarly, a principle that emphasizes auditability is only viable if the organization can reconstruct the agent's actions, the data it accessed, the user it represented, and the resulting outcome. By placing governance at the data layer, it remains consistent regardless of the agent's construction or behavior, as the control resides within the database itself, not as a mere promise from the agent. Agent behavior may be probabilistic, but governance cannot be either. Enterprises should not rely on models adhering to policy; instead, the policy must be enforced by the system. This distinction lies between hoping an actor adheres to bounds and constructing bounds that the agent cannot surpass. The mechanisms to achieve this are prevalent at the data layer in many enterprises: role- and attribute-based access controls, row and column-level security, classification and masking, policy-as-code, and comprehensive audit trails. Agents alter the purpose for which these controls are applied; they do not change the mechanism itself. Identity management must recognize the agent as a principal with its own identity and purpose declared upon session initiation. Once the purpose is bound to identity, the policy engine can evaluate it similarly to how it assesses roles or departments, and the record of events can capture not only who acted and what they accessed but also what they declared their intent to be. In practice, this translates to nine controls, organized under three key imperatives: enforce it, role- and attribute-based access control enforced at query time for agents as well as users, dynamic column masking driven by the same policy path, agent identity as a first-class principal with declared purpose bound at session start and user preservation, session-level audit logging that records the agent, user, and declared purpose, lineage across pipelines for tracing results back to the initiating request, unified and hardened centralized policy management, encryption at rest and in transit, and consistent enforcement across on-prem, cloud, and sovereign or air-gapped environments. Priyanka Jain, EDB's VP of product management for data & AI governance, emphasizes that declared purpose becomes an attribute understood by the access layer, evaluated in the same policy path as roles and row-level security. The enforcement mechanism remains unchanged; what shifts is that the agent's purpose is now part of what it evaluates and what the record proves afterward. Regardless of where an enterprise is in its AI adoption journey, enforcement at the data layer enables faster progress rather than slower implementation. The controls already exist within the database. The difference lies in agents now needing to navigate through them. This approach provides a digital leash, not a locked door, allowing enterprises to define how far an agent can go, what it can access, what it can modify, what requires escalation, and how the organization can reconstruct events in case of issues. Governed in this manner, agents are identifiable, scoped, monitored, and auditable, enabling the enterprise to adopt them more swiftly as security, risk, and leadership teams trust the underlying operating model. Built on open source PostgreSQL, EDB's foundation allows enterprises to retain control over data location, access permissions, and policies without relinquishing governance to an untrustworthy layer. For regulated industries, this blend of data sovereignty and source-level enforcement is not merely beneficial—it is a prerequisite for deploying agents in production. As agentic systems become more capable and autonomous, this approach will remain essential.",
  "summary": "Presented by EDB As enterprises give AI agents more autonomy — the ability to plan, decide, and act across systems without a human approving each step — a hard question moves to the center of every architecture review: When an agent tries to complete an action that it was never authorized to do, what actually stops it? These are your agents, running on your models, touching your data in your…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}