Controlling what AI is allowed to know

Imagine an AI agent tasked with preparing a customer account summary. To complete the job, it requests information from several business systems, including customer records, financial data and internal correspondence. Some of that information may be relevant. Some may be sensitive or entirely unnecessary. But if the AI decides it needs the information, who determines whether it should actually receive it?

AI is crossing an important threshold. It is moving from technology that generates answers to technology that can make decisions, initiate processes and act across enterprise systems. That changes the security question significantly.

For much of the AI era, attention has understandably focused on securing the model: preventing manipulation, controlling tools, protecting identities and ensuring AI behaves as intended. Whilst those safeguards remain essential, as AI becomes more capable of acting independently, enterprises need to protect another critical point in the architecture. The moment AI reaches enterprise data in order to make or execute a decision.

This is the decision boundary between AI intelligence and enterprise information. An AI system may conclude that it needs customer records, financial information, employee data, operational signals or external intelligence to complete a task. Its reasoning may be entirely legitimate. But deciding that information is useful and being permitted to receive it are fundamentally different. For business leaders, the challenge is making sure AI can do its job without gaining access to information it has no business seeing.

Don’t confuse an AI request with permission 
The decision boundary creates a point at which the enterprise can independently determine whether a request for information is appropriate. Who is the AI acting for? What task is being performed? What information is required? Is the request consistent with the user’s permissions and the purpose of the task? Do privacy, security, regulatory, or geographic restrictions apply? These decisions should not depend solely on instructions embedded inside the AI application. Enterprise policy needs to remain enforceable independently of the intelligence requesting the information.

For example, an AI agent helping a sales employee prepare for a customer meeting may need access to account history and recent interactions. That doesn’t mean it should automatically receive confidential financial records or sensitive employee information, even if it believes those details would help complete the task. Businesses should define what information an AI agent needs for a particular task and ensure its access reflects the permissions of the person it represents. The AI can identify what information might be useful, but the business must retain the authority to decide what can be shared.

Approve the information, not just the AI tool 
This also changes how organisations should think about AI governance. Approving an AI application cannot mean approving every future data request that application might generate. Agentic systems are dynamic. The information required for one task may be entirely inappropriate for another. The same agent may operate for different users, in different business processes and under different regulatory requirements. Governance therefore needs to become more dynamic too.

The important question becomes not simply “Is this AI approved?” but “Should this information be available for this purpose, to this requester, right now?”. That means moving beyond a one-off decision about which AI tools employees can use. Access controls must also account for the specific task being performed and the information being requested.

An AI agent might be permitted to access certain information when supporting one employee or business process, but not when carrying out a different task. Access decisions therefore need to reflect the circumstances of each request, including who the AI is acting for and why the information is needed.

Give AI the right information, not unrestricted information
People tend to assume that better AI requires access to more enterprise data. In practice, trusted AI requires something more precise. It needs the information necessary to understand the situation and perform the task, while enterprise controls determine what should remain outside its reach.

That distinction matters for security, privacy and trust. It also matters for AI quality. Giving AI indiscriminate access to information does not necessarily lead to better decisions; it can introduce irrelevant, sensitive, or inappropriate information into the reasoning process. The goal should therefore be appropriate access, not maximum access.

A useful starting point for businesses is to examine the tasks they are asking AI agents to perform and identify the information genuinely required to complete them. From there, they can establish clear boundaries around what should remain inaccessible, even when an agent requests it.

The aim isn’t to restrict AI unnecessarily. It’s to give it the information needed to do its job well, without introducing sensitive or irrelevant data that could undermine the quality of its decisions. Better access controls can therefore support more reliable AI outcomes, as well as reducing security risks.

Keep a record of what AI can see
As AI participates in more business processes, organisations will also need a clear record of how it interacts with enterprise information. Which information was requested? Why was it required? What was made available? Which policies applied? On whose behalf was the request made?

This creates accountability at precisely the point where AI reasoning begins to influence enterprise decisions. And it becomes increasingly important as one agent calls another, tasks cross organisational boundaries, and AI-driven workflows become more complex.

Businesses should be able to trace how an AI agent accessed information and understand why that access was permitted. Without that visibility, it becomes harder to identify inappropriate requests or demonstrate that sensitive information is being handled correctly.

Build security into the way AI accesses data
None of this replaces cybersecurity, identity management, model safeguards or the security controls already operating within enterprise platforms. It complements them. Enterprise AI requires an independent control point between AI reasoning and distributed enterprise information – a place where identity, purpose, policy, business meaning and the circumstances surrounding a request can determine what information is made available. This is likely to become one of the defining architectural requirements of enterprise AI.

For businesses, this represents a shift in how AI security needs to be designed. Protecting the model and managing user identities remain essential, but organisations also need an independent layer of control between AI reasoning and enterprise information. This allows businesses to apply their own policies to every data request, rather than relying on individual AI applications to determine what information they should receive.

The question facing organisations is no longer simply whether they can trust AI to make increasingly sophisticated decisions. They also need to decide what AI is allowed to know before it makes decisions. If an AI agent requests sensitive information tomorrow, who or what decides whether it gets access?