An AI agent hands your team a recommendation. It looks reasonable and it's accurate. The model didn't hallucinate. Can your organization trust it?
That question has less to do with the model than with the data behind it. Accuracy and trustworthiness are different properties. A correct answer can still rest on information the user shouldn't have accessed, pull from a system nobody approved, or send sensitive records somewhere they don't belong.
The stakes climb as AI moves from answering questions to taking action. A chatbot that drafts a summary presents one kind of trust problem. An agent that retrieves records, updates a system and sends an email presents another. The more autonomy an agent has, the less any single permission check can tell you.
Access isn't the same as intent
Picture a support agent working a customer case. It signs in with valid credentials, works only in approved systems, and closes the ticket. A review of that workflow would come back clean.
Now suppose that partway through, the agent decides a broader search might help. It pulls records from unrelated customer accounts and exports them to a shared workspace the team also uses with an outside party. Nothing is flagged, because every step was permitted and the destination was approved. Later, someone asks the questions every security team dreads: which records left, where did they go, and who can see them?
We call this intent drift: an agent taking actions that sit inside its technical permissions but outside its business purpose. It doesn't look like a breach, because the credentials, the data and the tools are all legitimate.
Least privilege is table stakes, and no agent should be deployed without a defined scope. But permissions decide whether an agent may touch data. They can't tell you whether the task needs it.
Three questions to ask about every AI workflow
Following the data swaps a sprawling question (what could this agent reach?) for a testable one (what did it do?). Three questions get you there: source, path and purpose.
1. Source: where did the data come from?
Start with origin or provenance: the system, owner, and repository the data came from. NIST's Generative AI Profile (AI 600-1) calls for documenting and tracking data sources and provenance as part of managing AI risk. Origin also has to connect to permissions and context. An agent may have been technically able to retrieve a document, but whether it should have used it is a separate question.
2. Path: where did it go?
Data rarely travels straight from source to model. It's exported, summarized, handed to an application, passed to a model and acted on downstream, and each hop can change its context.
Think about how money laundering works. Criminals rarely make one obvious transfer. They break money into pieces, move it through layers of accounts until it looks legitimate, and bring it back into the open. Every individual transaction looks normal, so banks catch it by following the money across the whole path, not by watching one account.
Data can follow the same pattern, whether an insider or an agent working for one is doing it: pull sensitive data from a system like Salesforce, run it through AI to summarize or rewrite it, then send the clean-looking result out through an ordinary channel. A tool that watches only AI prompts, or only email, sees one account and misses the path.
3. Purpose: did it belong there?
The last question is the one permissions can't answer. The same export of customer records means one thing when it follows the case an agent was assigned and another when it follows a sweep of unrelated accounts. Purpose is what separates them.
Answering it takes the history of the data itself: where it came from, who or what touched it, how it changed, and where it went next. That history is data lineage, and it is how Cyberhaven traces the full lifecycle of data. In the support example, lineage shows the exported records starting in a CRM query, moving through the agent's session, and landing in an external workspace within minutes. A permission list could never show it, because every action was allowed.
Where to start
The practical shift is to ask a different question of every AI workflow: what happened to the data? An access review says what an agent can reach. It doesn't show where the records went afterward. Three steps put the question to work:
- Define each agent's purpose specifically enough to check. "Help with support" can't be tested against data movement. "Resolve this customer's case using that customer's records" can.
- Review data paths alongside access. Treat permission review and data path visibility as two views of the same agent. The second gives executives and boards evidence of what an agent did with sensitive data while the workflow is still running.
- Hold humans and agents to one standard. The same rule should protect customer data whether it leaves through Gmail, a USB drive, ChatGPT or a coding agent.
Organizations that trace data from origin through transformation, AI interaction and downstream action can make AI more accountable without slowing it down. That is the thinking behind Data Security for the Agentic Enterprise: Cyberhaven traces the full lifecycle of your data, adapting protection to changing context.
