Agentic Data Engineering Resources

Resource

Data Governance for AI Agents: Who Controls What the Agent Sees?

Explore data governance for AI agents across ownership, runtime enforcement, auditability, and Airbyte's agentic platform context architecture.

Pedro Lopez

August 26, 2026

Last updated September 3, 2026

Summarize with AI:

Data owners should control which sources and fields AI agents may access, while security teams own identity and credentials, platform teams enforce retrieval policy, and application owners govern actions. Governance fails when these approvals exist only on paper because an agent can retrieve restricted data before a periodic review detects the violation. An effective model assigns a named owner to every access decision, enforces that decision along the full data path, and produces evidence showing what the agent requested, saw, and changed.

TL;DR

Governance requires a named owner for every decision about the data an agent can read and the actions it can take.
Teams must enforce policy at six points along the agent data path, from the source access grant to audit review.
Runtime assembly fragments credentials, policies, and logs across connections, while a pre-materialized context layer centralizes retrieval and observability under shared controls.
Pre-materialized context introduces refresh lag, so teams must reconcile permissions and reserve live API calls for fresh state and writes.

Get started to give your agents governed, permission-aware access to enterprise data without having to hand-build a pipeline for every source.

What Does Data Governance Control for AI Agents?

Data governance for AI agents is the system of decision rights and runtime controls that determines which business data agents can read and which actions they can take. Together, these controls define who owns agent access and where teams enforce it. An operational governance model also records the evidence each owner must produce and the conditions that trigger escalation. Without that evidence, policy violations remain indistinguishable from legitimate agent activity.

Why Do Traditional Governance Models Break for AI Agents?

Traditional access reviews cannot keep pace with agents that generate access requests continuously at machine speed. A review cadence built for human provisioning cannot evaluate requests arriving at that rate, so an agent may already have read restricted data before the review cycle closes.

Persistent identities retain static role-based access control (RBAC) permissions, making that model a poor fit for ephemeral non-human identities. These task-specific machine identities spin up for a task and dissolve when it completes. A security-professional survey of 383 IT and security professionals found that 78% of organizations lacked documented policies for creating or removing AI identities.

Connection sprawl compounds the problem. A Coalition for Secure AI analysis found that an agent's effective permission set should include only the permissions shared by the agent and the user. Without enforcement of that shared permission set, an agent authorized for email may also connect to a Model Context Protocol server that exposes tools and data from your code repository to agents. The agent then holds both permission sets because MCP alone does not apply application-specific authorization boundaries, leaving ownership as the next required control.

Who Owns Source Access and Agent Identity?

Data owners, security teams, platform teams, application builders, and end users divide responsibility for source access, identity, query policy, and approved connections, and each role produces evidence and follows an escalation path. Data owners produce a signed connection request for each approved source, so any self-provisioned MCP connection triggers escalation. An employee who completes an OAuth grant to a SaaS tool without review has made an ownership decision that belongs to the data owner.

Security teams, in turn, maintain an agent identity record distinct from any human account. Any agent still running on a person's OAuth token triggers escalation because delegated OAuth flows can otherwise make the agent's activity appear to belong to the user. Together, these approvals and identity records establish the boundary that platform and application teams must enforce at runtime.

Who Enforces the Approved Data Boundary?

Approval alone does not control a running agent, so platform teams enforce the approved data boundary while application builders and end users operate within it. Platform teams produce access logs and maintain an organizational field-admission list that records the entities and fields approved by the data owner. Context Store is the pre-materialized context layer that holds this approved data. Permission drift occurs when a record's access rules change at the source before the replica catches up, so teams reconcile the permissions attached to those records against source permissions on a schedule.

Application builders, working inside that boundary, record the connections they configure and send requests for new entities or fields to the data owner rather than bypassing that owner. When a revenue operations user asks what a Salesforce-connected agent may see, a named owner and approval path provide a workable answer. Without that path, each exception becomes an unmanaged expansion of the agent's data boundary.

Where Must Teams Enforce Policy Along the Agent Data Path?

The agent data path starts with the initial source grant and credential issuance. It continues through admission into the context layer, query-time retrieval, write-back, and audit review. Authentication tells you who the agent is. Authorization decides what this specific request may return, and teams enforce the two at different points.

Source authorization does not automatically become index authorization. When teams copy data into a search index or replica, they must preserve source permissions. Teams must run the permission check before retrieval. Once the model has generated an answer from data it shouldn't have seen, a later authorization check cannot undo the exposure.

For database retrieval, assign the agent's database connection a low-privilege pool. The pool should only SELECT from views that drop personally identifiable information (PII) and other sensitive columns. The model can ask for anything it likes; the constraint holds because it lives in the database grant, not in a prompt. This governed data layer serves a different purpose from an MCP gateway, which authenticates, routes, and applies policy to tool calls. Teams must still define query-level access controls for every retrieval path.

Which Control Points Need Named Owners?

Each stage of the data path needs a named owner, a defined decision, and an observable way it breaks when unowned.

Control point	Decision made there	Typical owner	What breaks if unowned
Source access grant	Which systems an agent may connect to	Data or system owner	Employees self-provision MCP connections to SaaS tools without IT oversight
Credential issuance	Whose identity the agent acts under	Security or identity team	Agent runs on a borrowed personal OAuth token, so logs attribute its actions to the human
Admission into the context layer	Which entities and fields enter Context Store	Platform team with data-owner sign-off	Platform team adds sensitive fields, such as PII or compensation data, without review
Query-time retrieval	Which records a specific request may return	Platform team through policy enforcement	Source and replica permissions drift apart
Write-back and actions	Which actions require human approval	Application owner and security	Agent modifies production records without an approval gate
Audit review	Who inspects access logs and escalates	Security or compliance	Logs omit agent reads, so incidents surface only after exposure

Teams can implement these controls in sequence: inventory agent identities and sources, assign owners, define field admission, enforce query-time checks, gate writes, and test logs. They should reconcile permissions after changes to the source access control list (ACL) and at a risk-based interval selected by the data owner. Useful operating metrics include failed API calls per run, token consumption per cross-system task, permission-reconciliation lag, access-review time, and the time required to approve a new source. These measurements reveal whether the architecture reduces governance work or merely moves it between teams.

How Does Context Architecture Determine Governability?

Runtime assembly distributes control across multiple connections, whereas a pre-materialized context layer centralizes it. With runtime assembly, the agent builds context by calling tools directly. Each connection carries its own credentials, scope model, and log format. Without a shared enforcement layer, teams must duplicate policy across connections, and those configurations can drift.

Revoking an agent's access can require changes to every connection configuration. To audit what the agent read, teams may need to correlate multiple log formats post hoc. Without an explicit owner, no team may review policy interactions among those separately configured connections.

A pre-materialized context layer centralizes the read path. The data owner signs off on a field-admission list, and the platform team uses the list to review and admit data. Stored context reads pass through one shared layer, while direct reads and writes use controlled live API requests. Teams can centralize context retrieval, observability, and credential management in that layer while maintaining a credential flow for each source. The tradeoff is that centralized replicas can become stale, making the boundary between stored context and live APIs a governance decision.

When Should Agents Use Live APIs?

Live API access still matters for fresh state and for writes; nobody should update a production CRM record from a replica. The governed read path makes audit records more consistent and easier to review, but both paths need explicit controls.

An expired OAuth token can interrupt an illustrative agent run before a required source returns data. A timeout or 429 response during multi-tool execution can leave the agent with only part of the requested cross-system context. Large records from several systems can also consume the token window before the model reaches the relevant evidence. Runtime assembly can therefore increase latency, token use, and rate-limit exposure as agent and connection counts grow. Partial context also complicates audits because a log must distinguish attempted access from data the agent actually received.

How Do You Audit What an Agent Saw?

Agent audit records need, at minimum, the agent's distinct identity, the requested action, the target system, the policy evaluation result, the execution outcome (approved or blocked), the data the agent accessed, and the timestamp. If the agent acts under a borrowed human credential, the audit trail assigns the agent's actions to a person who never performed them. You then cannot answer the incident-response question "what did the agent read?" Complete audit logs record both what an agent did and what it intended because, without the intended action, a harmful result can look routine.

Agent observability covers the monitoring layer that consumes these records; governance guarantees the records exist in the first place. To produce them consistently, route reads and writes through a surface that provides consistent security logging. That shared surface can also apply credential and workspace boundaries, but its consistency matters only if it preserves the organization's ownership decisions.

How Do Airbyte's agentic platform Put Governance in One Layer?

Airbyte's agentic platform applies this shared-surface model through Managed credentials, which securely store credentials, handle token refresh, and inject them into execution requests. That single point of custody replaces the per-connection credential handling that makes runtime assembly hard to audit.

Workspaces then isolate the underlying agent connectors and their credentials across teams, tenants, or environments, so credential review and revocation stay scoped to a defined boundary rather than spread across ad hoc connections.

The way owners express governance decisions matters as much as where those decisions run. The Agent SDK lets application and platform teams define field-admission rules, retrieval policies, and write gates as versioned code, so the field-admission list a data owner signs off on lives as a reviewable artifact in the same repository as the agent. The Agent CLI carries those same controls into continuous integration. Teams can script permission reconciliation after a source ACL changes, prove that a revoked grant actually blocks retrieval, and export access logs as audit evidence on a schedule, rather than checking each step by hand.

Centralization still does not decide which fields an agent may read or which actions require approval. Data, application, and security owners encode those decisions in field-admission rules, retrieval policies, write gates, and review procedures, and the SDK and command-line workflows give them a repeatable way to keep those encodings in sync with the running system.

Where Should You Start Governing Agent Data Access?

A workable governance model combines named ownership with controls that follow each request from source access through audit review. A pre-materialized context layer narrows the read-review scope and makes retrieval logs more consistent, while controlled live API access remains necessary for fresh state and writes. The practical starting point is to inventory agent identities and sources, assign an owner to each control point, and then test that revocation and reconciliation behave as the policy claims.

Airbyte's agentic platform applies this model by centralizing Managed credentials and governed reads through a shared context layer while isolating agent connectors and credentials by workspace. Its developer toolkit and command-line workflows let application and security owners keep field admission, approval gates, reconciliation schedules, and escalation paths defined as code they can review and rerun as sources change.

Get a demo to see how Airbyte's agentic platform stores credentials, handles token refresh, and isolates agent connectors and credentials by workspace.

Frequently Asked Questions

Does the EU AI Act Apply to AI Agents?

Applicability depends on the system category and deployment. Teams should map agent access paths to the obligations applicable to that category rather than waiting for agent-specific rules.

Does MCP Enforce Security at the Protocol Level?

No. MCP does not by itself apply application-specific consent, per-tool authorization, or request-level policy decisions. Implementations must configure those controls through the client, authorization server, gateway, or tool server.

What Is the Difference Between Least Privilege and Zero Standing Privileges?

Least privilege limits the scope of access; zero standing privileges limits its duration. A narrowly scoped permission that stays active for weeks satisfies the first and violates the second. A design that meets one and not the other still leaves an agent holding access it does not currently need.

How Many Tools Should One Agent See?

Governance reviews should inventory oversized tool sets and broader tool surfaces per agent. Keep each agent's active tool surface small and let a control plane manage the rest. Oversized tool sets can bloat context and increase the risk of wrong-tool use, so tool-surface sizing affects both governance and performance.

How Often Should Teams Reconcile Agent Permissions?

Use event-driven reconciliation after source ACL changes and a recurring, risk-based schedule selected by the data owner. Higher-risk sources need shorter intervals because stale replicas can retain access after source permissions change.