Anthropic zero trust for AI agents puts the data layer first

At a glance

What this is: This is Securiti’s analysis of Anthropic’s zero-trust guidance for AI agents, with the central finding that the data layer is the highest-leverage control point for governing agent access and limiting blast radius.

Why it matters: It matters because IAM, PAM, and data-security teams need a shared control model for AI agents, service accounts, and human access before autonomous workflows inherit weak data permissions at scale.

By the numbers:

• Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.

👉 Read Securiti's analysis of Anthropic zero trust for AI agents and the data layer

Context

AI agent governance breaks down when teams treat the model or runtime as the only security boundary. In practice, the data layer often determines how far an agent can move, what it can expose, and how quickly a mistake becomes an incident. That makes AI agent security a combined problem of discovery, access control, and data minimisation.

The article’s core argument is that zero trust for AI agents becomes more actionable when applied to data access rather than abstract model behaviour. That is directly relevant to identity governance because agents, service accounts, and other non-human identities all depend on entitlements that must be discovered, reviewed, and constrained before agentic workflows can be trusted at scale.

Key questions

Q: How should security teams govern AI agents that can access enterprise systems?

A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring. The control set should include inventory, task-bound credentials, audit trails, and revocation paths. If an agent can call tools or touch production systems, it belongs in the same governance model as service accounts and other machine identities.

Q: Why do AI agents create a different access-risk profile than traditional applications?

A: AI agents can chain actions, call multiple tools, and change behaviour based on context, so one credential can enable more than one operational path. That means the risk is not just whether the agent authenticates, but how far it can move once inside. The key measure is privilege scope, not token count.

Q: What breaks when organisations cannot see shadow AI usage?

A: When shadow AI is invisible, security teams lose control over where data is sent, which assistants are connected, and whether those systems can retain or expose sensitive information. That undermines policy enforcement, auditability, and incident response. It also means the organisation may be granting machine-driven access without a defined identity lifecycle.

Q: Who is accountable when an AI agent accesses sensitive data it was not meant to use?

A: Accountability sits with the team that approved the agent, its connectors, and its policy boundaries, not with the runtime behaviour alone. Organisations need ownership for intent, permissions, monitoring, and validation so they can prove whether the agent stayed inside its approved purpose. Without that, audit and regulatory response become retrospective guesswork.

Technical breakdown

Why the data layer is the control plane for AI agent blast radius

Zero trust for AI agents only works if teams can shrink the set of data an agent can reach before any prompt, tool call, or delegation happens. The key idea is blast radius: if one agent is manipulated, the damage is limited by the sensitivity and scope of the data available to that identity. That is why discovery, classification, and entitlement mapping matter more than post-incident reaction. In mixed environments, the same principle applies to service accounts, API tokens, and other non-human identities that agents may inherit or invoke.

Practical implication: Map every agent to the data it can reach and remove broad access before deployment.

Least privilege versus least agency for AI agents

Least privilege answers what an identity can access, while least agency asks what it can do with that access. For AI agents, that distinction matters because tool use, retrieval, and memory can turn access into action very quickly. A model may only need read access to a dataset, but its connected tools may let it copy, transform, or publish information in ways the business never intended. The governance problem is therefore not just permission assignment, but constraining task scope, output paths, and side effects.

Practical implication: Define task-scoped permissions and restrict downstream actions, not just source access.

Shadow AI makes discovery a governance control, not a discovery exercise

Shadow AI emerges when models, copilots, and agents are enabled inside SaaS apps or connected by teams without security visibility. That creates an inventory problem with direct identity impact, because unknown agents often run on over-permissioned service accounts or inherited access paths. Discovery must therefore track both the AI system and the identity behind it. Without that linkage, least privilege, monitoring, and incident response all operate on incomplete data and cannot reliably prove what an agent touched.

Practical implication: Inventory AI systems alongside the identities and secrets they use, then review them as one control set.

NHI Mgmt Group analysis

Data-centric agent governance is now the practical form of zero trust for AI. Anthropic’s framework is strongest when it pushes security teams to think about reach, not just runtime behaviour. The real control question is what data an agent can touch before any model-level safeguard is consulted. That shifts the centre of gravity toward data discovery, classification, and entitlement reduction, which are already familiar governance disciplines for identity and access teams.

Fleet risk is the missing assumption in most agent security discussions. A single agent with overbroad access is a contained exposure, but a fleet of agents sharing the same weak data foundation becomes an architecture problem. The vulnerability is not the presence of one misbehaving model. It is the repeated inheritance of the same poor data permissions across every new workflow, which makes the exposure systemic rather than isolated.

Least agency is a more precise control concept than least privilege for agentic systems. AI agents do not just read data, they chain retrieval, tool use, memory, and output. That means governance must limit both access and the permitted use of that access. This aligns naturally with NHI governance and emerging agentic AI control thinking, because service accounts, tokens, and delegated identities need task boundaries rather than static trust.

Shadow AI is now an identity lifecycle problem as much as a discovery problem. Untracked copilots and agents are often created faster than offboarding, rotation, and review processes can catch up. The governance failure is lifecycle drift: identities appear, gain data reach, and persist without a clear owner or review cadence. Practitioners should treat AI inventory, identity ownership, and entitlement review as a single operational control.

Data minimisation is the clearest way to turn AI trust into something deterministic. Probabilistic model behaviour can be managed, but not eliminated. Data that is minimised, masked, or revoked is either present or absent, which gives security teams a hard control rather than a soft assurance. That makes data governance the most defensible foundation for zero trust in agentic environments.

What this signals

Agent governance will increasingly be measured by data reach, not model sophistication. As AI systems proliferate, the operational question becomes whether security teams can show which data each agent can touch and why. That pushes identity governance, data classification, and entitlement review into the same operating rhythm, because a control gap in one layer quickly becomes a failure in the others.

Blast-radius reduction is becoming the most practical security objective for agentic programmes. If teams cannot guarantee that an agent will behave safely, they can still limit the damage it can cause by constraining sensitive data paths. The most mature programmes will treat masking, minimisation, and offboarding of stale access as primary controls rather than afterthoughts.

Shadow AI discovery will need to link identities, secrets, and data paths in one inventory. That is where the governance burden sits in real environments, especially when agents are embedded inside SaaS tools and business workflows. Practitioners should expect agent inventories to become part of broader identity lifecycle management rather than a standalone AI exercise.

For practitioners

• Inventory agents and their underlying identities Build a live register of every model, copilot, and AI agent, then tie each one to the service account, token, or non-human identity it uses. Include shadow AI and unapproved pilots so access reviews are based on actual reach, not assumptions.
• Right-size data access before agents go live Classify the data each agent can reach, then remove broad read and write entitlements that are not needed for the task. Prioritise highly sensitive repositories, shared file systems, databases, and APIs where over-permissioned access creates the biggest blast radius.
• Apply masking and minimisation to high-risk datasets Use dynamic masking and data minimisation to reduce what an agent can expose even when access exists. Remove redundant, obsolete, and trivial data from the paths agents can query so sensitive records are not reachable in the first place.
• Separate agent identity controls from data governance Keep runtime isolation, authentication, and response controls in the agent stack, but make data inventory, access intelligence, and classification part of the same governance workflow. That linkage is what lets you prove who touched what data and why.

Key takeaways

• AI agent security fails when teams focus only on the model and ignore the data layer that actually defines blast radius.
• The evidence points to a fast-scaling governance gap, with most organisations expanding agent use faster than they can audit access.
• Practitioners should treat agent inventory, entitlement reduction, and data minimisation as one control path, not separate programmes.

Key terms

• AI Agent Blast Radius: The amount of sensitive data, systems, or business action an AI agent can affect if it is misused or manipulated. In practice, blast radius is determined by the agent’s permissions, tool access, and the sensitivity of the data it can reach.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Least Agency: The agentic equivalent of least privilege — the principle that AI agents should be granted only the minimum level of autonomy necessary to complete their designated task, and no more. Coined in the OWASP Top 10 for Agentic Applications 2026.
• Claim Minimisation: The practice of including only the identity attributes required for a specific access decision. In API security, claim minimisation reduces unnecessary data exposure, simplifies token review, and lowers the risk that broad identity context becomes a hidden authorisation dependency.

What's in the full article

Securiti's full analysis covers the operational detail this post intentionally leaves at the governance layer:

• A deeper walkthrough of how the data layer changes zero trust decisions for AI agents in production
• Specific examples of discovery, masking, and data minimisation workflows used to reduce agent blast radius
• How access intelligence, lineage, and evidence support compliance and incident response for agentic systems
• The relationship between agent identity controls and data-layer controls in mixed enterprise environments

👉 The full Securiti article covers the agent and data-layer controls, lineage, and compliance details behind this framework.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, machine identity security, and secrets management. It gives practitioners a common control language for governing agents, service accounts, and the access they inherit.