Data trust is the limiting factor in enterprise GenAI security

At a glance

What this is: This research argues that data trust, not model capability, is the hidden factor separating successful enterprise GenAI programmes from stalled ones.

Why it matters: It matters because AI tools and AI agents can expose weak data governance, overstated access assumptions, and enforcement gaps that affect both human and non-human identity programmes.

By the numbers:

• 90% of enterprises are already running Enterprise GenAI at scale.
• only 34% of CISOs describe themselves as reasonably confident in their AI data security controls.
• only 1 in 5 of those AI initiatives are meeting their intended KPIs.
• 32% of organizations already have unknown agents operating in their environments.

👉 Read Mind's report on data trust and enterprise GenAI security

Context

Enterprise GenAI changes the security problem from controlling a bounded user population to governing whatever the model can reach. When unclassified files, overshared repositories, and stale permissions sit behind an AI-enabled interface, the issue is no longer whether data exists, but whether access boundaries were ever real. That makes data trust a primary control concern for IAM, IGA, PAM, and NHI programmes alike.

The article’s core argument is that governance written for human judgment does not hold when software can query, retrieve, and combine data at machine speed. That is why the identity angle is genuine: AI agents inherit access, but they do not inherit discretion, so identity policy has to be enforced on the data and the runtime path, not just documented on paper.

Key questions

Q: How should security teams govern AI agents that can access enterprise systems?

A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring. The control set should include inventory, task-bound credentials, audit trails, and revocation paths. If an agent can call tools or touch production systems, it belongs in the same governance model as service accounts and other machine identities.

Q: Why do enterprise GenAI tools expose hidden data governance problems?

A: Because they query at scale and immediately surface whatever the organisation already left reachable. Unclassified files, overshared repositories, and stale permissions become visible the moment a model connects to them. AI does not create the weakness, but it removes the obscurity that kept the weakness from becoming operational risk.

Q: What breaks when AI security relies only on policy and review?

A: Policy-only programmes break because they describe expected behaviour without constraining live execution. Review tells you what should have happened, not whether the agent followed a malicious prompt, retrieved restricted data, or called the wrong tool. Without runtime enforcement, control evidence arrives after the decision has already been made.

Q: How do organisations know whether AI data trust is actually improving?

A: Look for fewer overshared repositories, clearer classification coverage, narrower agent permissions, and logs that show real-time enforcement rather than post-hoc review. If AI initiatives keep finding sensitive material that should have been hidden, then the governance model is still below the threshold needed for safe scale.

Technical breakdown

Why enterprise GenAI exposes data governance gaps

Enterprise GenAI does not create access on its own, but it can instantly reveal access that was already too broad. Once a model is connected to repositories such as SharePoint, file shares, or data platforms, it can surface unclassified files, overshared folders, and sensitive content that had remained hidden because nobody queried it at scale. The governance problem is usually not the absence of policy. It is the absence of classification, scoped permissions, and enforcement that work when retrieval is automated and continuous.

Practical implication: classify sensitive content before connecting GenAI to enterprise repositories.

How AI agents break human-centric access assumptions

AI agents inherit permissions but do not apply human judgment about what is appropriate to open, combine, or disclose. That matters because many enterprise controls assume a person will notice context, pause before overreach, and self-limit. An agent does none of those things. It will operate within whatever access it receives, and if those privileges are broad or unclearly scoped, the blast radius expands immediately across systems, data sets, and workflows.

Practical implication: treat AI agents as governed software identities with explicitly scoped permissions and monitored access paths.

What policy enforcement means at AI speed

Policies, training, and documentation do not prevent overexposure if the control plane cannot enforce them in real time. AI introduces a speed mismatch: access decisions happen as part of retrieval and inference, not during a human review cycle. That is why governance has to shift from advisory controls to runtime enforcement, including data filtering, access mediation, logging, and exception handling that can keep up with automated queries and agent actions.

Practical implication: move from policy-only governance to runtime enforcement for data access and agent behaviour.

Threat narrative

Attacker objective: The objective is to use AI-connected data access to uncover sensitive information, widen visibility, and enable misuse of material that governance never properly constrained.

1. Entry occurs when an Enterprise GenAI tool is connected to repositories that were never fully classified or access-scoped.
2. Escalation happens when the model retrieves overshared content, effectively expanding visibility beyond the original human access boundary.
3. Impact follows when sensitive files, credentials, or business data become discoverable to wider internal audiences or downstream AI workflows.

NHI Mgmt Group analysis

Data trust is now the control plane for enterprise AI. Boards can approve AI programmes and security teams can write policy, but neither outcome matters if the organisation cannot prove what data is classified, who can reach it, and whether that access is enforced in runtime. In practice, AI turns latent governance debt into visible risk. Practitioners should treat data trust as a measurable security condition, not a business slogan.

AI agents create a new class of non-human access problem. The article is not just about GenAI adoption. It is about software entities operating with inherited permissions that were originally granted for human use. That shifts the governance question from whether users are trusted to whether machine actors are bounded, monitored, and revocable. In an NHI context, the agent is the identity, and the identity has to be governed as software, not as a proxy person.

Governance without enforcement fails at machine speed. The article’s strongest point is structural: policy and training cannot keep pace with automated retrieval and inference. That is a familiar pattern in identity security, where documented intent often lags operational reality. In this case, the named concept is AI data trust gap, meaning the distance between approved policy and what AI systems can actually reach. Practitioners should close that gap before scaling AI further.

Unknown agents make identity governance less visible, not less important. When 32% of organisations already have unknown agents in their environments, the problem is not hypothetical. It means asset inventories, access reviews, and ownership models are already incomplete. That also raises the stakes for IGA, PAM, and NHI lifecycle control, because you cannot govern what you have not identified. Practitioners should assume hidden machine identities until discovery proves otherwise.

Security teams should stop measuring AI risk only by model behaviour. The article makes clear that many failures happen one layer lower, in the data estate and entitlement model that the AI consumes. That means the right governance lens is not just prompt safety or output moderation. It is whether the underlying data, secrets, and access paths are fit for machine consumption. Practitioners should align AI oversight with identity and data control ownership.

What this signals

AI data trust will become a programme-level KPI, not just a technical aspiration. As enterprise GenAI expands, security leaders will be judged on whether they can show measurable reductions in oversharing, unmanaged access, and agent sprawl. The practical signal is simple: if AI can find it, then the governance model was already too loose. That is why identity, data, and AI security teams need a shared control narrative, not separate dashboards.

Machine identities will force IAM and IGA teams to adapt their operating model. The growth of AI agents means access reviews, ownership assignment, and entitlement cleanup cannot stop at human accounts. A useful reference point is NIST AI 600-1 GenAI Profile, because AI governance now depends on both model risk and the identity of the systems using the model. Practitioners should plan for discovery, approval, and revocation workflows that cover non-human actors.

Runtime enforcement will matter more than framework maturity statements. If governance cannot interrupt a retrieval event, it is not a control, it is a record of intent. That shifts attention toward classification, mediated access, and telemetry that security operations can actually use. For identity teams, this is where NHI controls, secrets governance, and agent oversight converge into a single operational problem.

For practitioners

• Inventory AI-connected data paths Map every repository, connector, and retrieval path used by enterprise GenAI tools before expanding usage. Pay special attention to SharePoint, file shares, knowledge bases, and other stores where sensitive content may be overshared or unclassified.
• Re-scope AI agent permissions Assign machine identities the minimum permissions needed for each workflow, and separate read, write, and administrative access. Do not allow inherited human access bundles to pass into agent workflows unchanged.
• Enforce classification at the data layer Apply data classification and access mediation to the repositories AI can reach, so sensitive files are filtered or blocked before retrieval. Policy alone is not enough when the system can search across all reachable content.
• Add runtime logging for retrieval and agent actions Log what the AI queried, what it retrieved, and which identities or agents triggered the action. That creates an audit trail for incident response, entitlement review, and exception handling.

Key takeaways

• Enterprise GenAI is exposing a governance gap that policy alone cannot close, because AI systems immediately surface whatever data is already reachable.
• The research links weak data trust to poor AI outcomes, with only 1 in 5 initiatives meeting intended KPIs despite broad adoption.
• Security teams need runtime enforcement, tighter machine identity scope, and better data classification before scaling AI further.

Key terms

• Data trust boundary: A data trust boundary is the point where identity, data classification, and policy enforcement meet. It defines what a human or non-human actor is allowed to see and do with sensitive information, and it must be explicit when AI agents operate inside production data platforms.
• AI Agent Identity: The digital identity used by an autonomous AI agent to authenticate to external systems, APIs, and services. Managing AI agent identities is an emerging and rapidly evolving area of NHI security.
• Runtime Enforcement: Runtime enforcement is the practice of blocking malicious behaviour while software is running, rather than only detecting it after the fact. It monitors process activity, network actions, and privilege changes so a live attack can be interrupted at the point of execution.

What's in the full report

Mind's full report covers the operational detail this post intentionally leaves for the source:

• The survey methodology behind the 124 CISO responses and 20 qualitative interviews
• The seven research insights that connect data trust, AI adoption, and governance failure
• Practical guidance on building a minimum viable security foundation for enterprise AI
• The article's internal case examples showing how overshared repositories become exposed through GenAI

👉 Mind's full report covers the survey findings, practitioner interviews, and security foundation needed for AI at scale.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, secrets management, and identity lifecycle fundamentals. It helps security and identity practitioners build the operating model needed for AI agents and other non-human identities.