Should organisations use content filters or purpose-based access control for AI agents?

Why Access Control Has to Come Before Filtering

Content filters are useful, but they work on what the agent has already produced or retrieved. Purpose-based access control is earlier in the chain, because it decides whether the agent is allowed to touch a tool, dataset, or workflow at all. For AI agents that can execute actions, browse internal systems, or call APIs, that distinction matters more than the prompt text itself. The strongest governance pattern is to constrain the agent’s purpose, then apply content controls as a second layer.

That ordering is reinforced by current field data. In AI Agents: The New Attack Surface report, 80% of organisations said their AI agents had already performed actions beyond their intended scope, including unauthorised system access, sensitive data sharing, and exposure of access credentials. When agents are already capable of overreach, filtering alone is too late in the chain.

In practice, teams usually discover the problem after an agent has already been granted broad tool access, not when a bad output slips past a text filter.

How They Work Together in Practice

Purpose-based access control defines what the agent may do, while content filters reduce harm from what the agent says, writes, or returns. For high-risk AI workflows, the access decision should be tied to the task, the target system, and the data class involved. That means an agent can be allowed to draft a response but denied the ability to query sensitive records, send messages, or write to production systems unless the specific purpose justifies it.

Content filters still matter because they catch unsafe outputs that authorised actions can produce, such as leaking secrets, echoing personal data, or generating harmful instructions. They are especially useful when agents summarise untrusted content, transform user input, or operate in open-ended conversational flows. But they should be treated as a containment layer, not the main control boundary.

• Use purpose-based access control to decide whether the agent can reach a system, dataset, or tool.
• Use content filters to inspect prompts, retrieved context, and generated outputs for leakage or unsafe patterns.
• Apply stricter access rules where an agent can take irreversible actions, such as deletion, payment, or external messaging.
• Log both the authorisation decision and the resulting action so investigators can reconstruct intent and effect.

For agentic systems, this layered model aligns with current guidance from the OWASP Top 10 for Agentic Applications 2026, which emphasises controlling what an agent is permitted to access and execute, not just sanitising text after the fact. These controls tend to break down when one agent is reused across many workflows with shared permissions and no task-level scoping.

Common Variations and Edge Cases

Tighter access control often adds operational overhead, so organisations have to balance friction against blast-radius reduction. That trade-off becomes sharper when an agent serves multiple teams, because a single permissive policy can become the easiest way to keep users productive. In those cases, it is better to create narrower purpose profiles than to rely on one universal agent persona with broad reach.

There is also a real distinction between read-only and action-capable agents. A read-only assistant can usually tolerate stronger emphasis on content filtering, because the main risk is leakage or incorrect guidance. An action-capable agent needs access control first, because the business risk comes from execution. Purpose-based controls should be revisited whenever the agent gains new tools, new data sources, or new privileges, since the security boundary changes with capability.

Guidance is still evolving on how to measure the right balance between policy precision and user productivity, but the practical rule is straightforward: if the agent can cause real-world effects, control entitlement before you control wording. Content filters are a safeguard, not a substitute for authority boundaries.

Practitioner Guidance

What to prioritise: Start by classifying the agent by purpose and impact, then restrict tool and data access to the minimum set needed for that purpose. If an agent can write, send, delete, or exfiltrate, treat that as a high-risk entitlement decision rather than a content-moderation problem.

What to verify: Confirm that every privileged action is mapped to an explicit purpose, owner, and approval path. The key test is whether a reviewer can explain why the agent was entitled to act, not just whether its output was filtered after generation.

Practitioner takeaway: Use content filters to reduce harm in what the agent produces, but use purpose-based access control to stop the wrong action from happening in the first place.

Related resources from NHI Mgmt Group

• How should security teams govern AI agents that use OAuth access?
• How can organisations govern AI agents that use service accounts and tokens?
• How should organisations use AI agents in access reviews without losing governance control?
• Why do AI agents force organisations to move beyond traditional role-based access control?