How should teams govern AI systems that can combine data across business apps?

Why This Matters for Security Teams

AI systems that combine data across business apps do more than retrieve information. They can correlate customer records, HR data, ticketing history, and finance context into a single response that no single user role should be able to reconstruct. That makes the system a privilege amplifier, so governance must focus on the business effect of access, not only the token used to call the model. NIST Cybersecurity Framework 2.0 is useful here because it forces teams to connect identity, data, and risk outcomes rather than treat them as separate controls.

In NHIMG research on secrets and AI exposure, the average estimated time to remediate a leaked secret is 27 days, even though organisations often believe their secrets management is strong; that gap matters when an AI connector can be abused before a human review catches it, as shown in The State of Secrets in AppSec. The same pattern appears in Top 10 NHI Issues, where long-lived access and weak lifecycle discipline repeatedly turn routine integrations into high-impact exposure paths. In practice, many security teams discover the risk only after an AI workflow has already combined data that should never have been visible together.

How It Works in Practice

The practical control objective is to govern what the AI system is allowed to combine, not just what each app allows in isolation. That starts with classifying data sources by sensitivity and defining permitted joins, such as support tickets plus product usage data, but not support tickets plus payroll or medical leave records. The system should authenticate as a workload identity, not as a human shadow account, and every request should be evaluated at runtime against policy.

Current guidance suggests three layers of control:

• Workload identity for the AI service and each connector, so access is attributable and revocable.
• Just-in-time credentials or short-lived tokens for each task, so access expires quickly after use.
• Policy-as-code that checks the request context, the data classes involved, and the intended action before any join occurs.

That model aligns with the direction of the NIST Cybersecurity Framework 2.0, especially where access control and monitoring need to reflect real business risk. It also fits the lifecycle emphasis in Ultimate Guide to NHIs - Lifecycle Processes for Managing NHIs, because connector provisioning, rotation, and revocation are operational events, not one-time setup tasks. Teams should log the source systems queried, the fields returned, the prompt or task context, and the final output classification, then review whether the output exceeds the visibility of any single source role. These controls tend to break down in sprawling SaaS environments with unmanaged app-to-app integrations because data lineage and entitlement mapping are incomplete.

Common Variations and Edge Cases

Tighter combination controls often increase workflow friction, requiring organisations to balance analyst productivity against overexposure risk. That tradeoff is real, especially when business users expect the AI to “just know” everything across CRM, ERP, and support platforms. Best practice is evolving, but there is no universal standard for this yet, so teams should document approved combination patterns and revisit them as business processes change.

One common edge case is delegated access: the AI may need to act on behalf of a user, but that does not mean it should inherit every entitlement the user has. Another is retrieval from multiple tenants or business units, where the same model can inadvertently infer restricted information through correlation even when no single source is sensitive on its own. NHIMG’s Ultimate Guide to NHIs - Regulatory and Audit Perspectives is a useful reminder that auditability matters as much as prevention, and the DeepSeek breach underscores how quickly exposed AI-adjacent data can scale into broader credential and record exposure. For agentic or autonomous systems, emerging guidance also supports alignment with Ultimate Guide to NHIs - Key Research and Survey Results when determining where long-lived access becomes unacceptable.

Related resources from NHI Mgmt Group

• How should teams govern AI media workflows that combine generation, editing, and export in one workspace?
• How should security teams govern AI gateway authorization across models, tools, and agents?
• How should security teams govern AI provider keys across multiple dashboards?
• How should security teams make NHI best practices usable across the business?