Topic starter
03/06/2026 5:13 pm
TL;DR: Enterprise AI adoption is shifting from chatbot pilots to agentic workflows, and Cyera argues that data security and data context now determine whether AI can be deployed confidently. The governance assumption that model usage is enough has collapsed because agents take actions, not just answers, and they need access control around the data layer.
Editorial analysis by NHI Mgmt Group, based on content published by Cyera: “RSAC Reflections: Data Is the Foundation for Successful AI”.
Key questions
Q: What breaks when AI governance is designed only for model outputs?
A: Governance breaks when it assumes the AI system only produces text or recommendations for humans to review.
Q: Why do agentic AI workflows make access abuse harder to contain?
A: Because they compress recon, validation and exfiltration into short, repeatable workflows that can outpace human review.
Q: How do teams know if AI data security context is working?
A: It is working when retrieval decisions match current entitlements, incident response can reconstruct what AI touched, and sensitive derivatives are visible across workflows.
Practitioner guidance
- Map agent data dependencies Inventory which datasets, prompts, and knowledge sources each AI workflow can reach, then classify them by sensitivity, business impact, and downstream action potential.
- Define runtime authorization boundaries Set policy for what an agent may access during a live task, including tool calls and data retrieval, rather than relying only on pre-approved roles or application-level access.
- Align data controls to agent context Tie classification, entitlements, and logging to the context an agent assembles at decision time so security can see which information shaped each action.
Bottom line: Enterprise AI governance is moving from model oversight to data-layer control because agents act on information as well as prompts.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
03/06/2026 5:16 pm
Data-layer governance is becoming the real control plane for AI adoption. The article is right to move the discussion away from model enthusiasm and toward the data boundary because that is where agent behaviour becomes governable. When the system can retrieve, combine, and act on data dynamically, the old separation between AI capability and security control collapses. Practitioners should treat governed data access as the primary enabler of safe AI scale.
A few things that frame the scale:
- Organisations that describe themselves as confident in their AI deployment actually experience a 72% security incident rate, compared to 33% for those who remain cautious, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should organisations govern access to data used by AI systems?
A: Treat AI data access as an identity governance problem, not just a data storage problem. Define who or what can use each dataset, what purpose is allowed, and what runtime restrictions apply. Then review humans, service accounts, and AI agents separately so entitlement scope matches actual behaviour rather than a generic AI policy.
👉 Read our full editorial: Data security is becoming the control plane for enterprise AI adoption