As agentic artificial intelligence deployments accelerate across global enterprises, a stark vulnerability is coming to light: while organizations rush to integrate autonomous agents into their production environments, they are largely doing so without the runtime visibility or granular controls required to keep them secure. Recent research from the Cloud Security Alliance highlights this growing disconnect, revealing that while roughly 70 percent of organizations now have AI components running in production, a staggering 82 percent lack real-time visibility into AI runtime behavior. Even more alarming, only 21 percent maintain a real-time inventory of their deployed agents, and an estimated 65 percent have already experienced a security incident tied directly to agentic AI.
These figures point to a fundamental industry-wide challenge in how modern enterprises secure autonomous systems. While the technology community has established robust authentication and authorization frameworks—mastering identity and access management (IAM) alongside advanced sandboxing techniques—a critical missing link remains. The industry struggles to seamlessly translate high-level governance policies into active runtime enforcement. Authored by industry experts including Ana Biazetti, Senior Principal Engineer for Red Hat AI, Umberto Manganiello, and Stuart Battersby, AI Safety and Model Evaluation Architect, recent technical analysis underscores that this is not an isolated challenge for a single open source project or corporate vendor, but a systemic hurdle facing the entire enterprise technology landscape.
The Over-Permissioning Crisis in Production
Despite powerful foundational building blocks like OAuth 2.0 and OpenID Connect (OIDC) for user authentication, alongside sophisticated authorization engines such as Open Policy Agent (OPA), the default pattern in production agent deployments remains heavily over-permissioned. Because configuring fine-grained, role-based policies is complex, error-prone, and historically disconnected from how organizational governance teams conceptualize data access, AI agents are frequently granted broad, indiscriminate access to enterprise data sources.
To understand the scope of this problem, consider a typical property and casualty insurance company. Within such an organization, an underwriting agent requires access to risk assessment data and property valuations to properly price new policies. Simultaneously, a claims adjuster agent needs access to specific policy details, historical claims data, and fraud indicators to process customer requests efficiently. Meanwhile, a compliance officer agent requires read-only access to audit logs and regulatory filings. While these represent three entirely distinct roles with completely separate data needs, the current state of agent deployments routinely grants all three agents access to the exact same superset of corporate data.
This over-permissioning occurs because the alternative has historically involved manually configuring complex authorization policies across a dizzying array of enforcement points. These include vector databases, feature stores, enterprise data catalogs, Amazon Simple Storage Service (Amazon S3) buckets, and Model Context Protocol (MCP) tool servers. Because each of these underlying systems operates with its own proprietary policy syntax, individual identity model, and unique configuration interface, the cognitive load placed on engineering teams is overwhelming. Consequently, users can easily prompt agents to request and retrieve data far outside their intended operational scope, simply because that data remains technically accessible to the broader agent environment.
Bridging Governance and Runtime Control
Current agent control paradigms implicitly assume that someone has already meticulously defined what an agent is actually authorized to do with specific data during a given task. In reality, a profound translation gap exists between high-level governance intent and low-level runtime enforcement. Governance, legal, and compliance teams typically draft policies in natural language documents that describe abstract roles, data classifications, access boundaries, and regulatory compliance requirements. Engineering teams then attempt to manually mirror these natural language intentions across multiple distributed systems.
Because each enforcement point features its own syntax and interface, maintaining alignment is exceptionally difficult. There is rarely any systematic validation to verify whether these configured enforcement points faithfully implement the original governance intent. When corporate governance policies inevitably change, organizations lack automated mechanisms to regenerate enforcement configurations or verify that existing setups remain compliant. Over time, the drift between policy intent and actual runtime behavior widens significantly.
A secondary technical challenge further compounds this complexity. Protocols like the Model Context Protocol (MCP) and similar agent-tool frameworks successfully answer specific tool-authorization questions, such as whether a particular agent is permitted to invoke a specific tool or connect to a designated service. However, data access control answers an entirely different question: when that tool executes, which specific assets, records, and fields is it allowed to return for a given user and task? That crucial decision must still be enforced across disparate feature stores, data catalogs, vector databases, and object storage buckets, each accessing the network directly with its own identity mechanism. Establishing a unified policy layer across all these points requires coordinating multiple policy engines and identity providers, creating an integration challenge that no single standalone tool solves today.
A New Open Source Approach to Policy Translation
To address these systemic vulnerabilities, an emerging open source methodology treats governance documents—the plain text guidelines written by legal, compliance, and risk teams—as the definitive source of truth, automating the translation process into concrete enforcement configurations. This approach does not introduce a new runtime proxy or attempt to replace existing authorization engines; rather, it functions as a dedicated translation and validation layer sitting directly between organizational governance and runtime enforcement.
The core workflow operates across three distinct stages. First, policy extraction analyzes natural language governance documents to extract structured access rules, utilizing natural language processing to identify specific user roles, data sources, permitted operations, and conditional access boundaries. The direct output of this phase is a machine-readable representation of governance intent.
Second, authorization rule generation maps these extracted policies directly to the enforcement configurations required by existing enterprise systems. This might involve generating access control lists for vector databases, permission policies for feature stores, bucket policies for object storage, or tool allowlists for MCP servers. The objective is not to invent yet another proprietary policy language, but rather to accurately generate correct configurations for the enforcement points already deployed within the organization.
Third, data access validation verifies that the newly generated configurations actually enforce the intended policies through a process akin to automated red-teaming for data access. This involves generating test scenarios that should successfully pass—such as an underwriter requesting legitimate risk assessment data—alongside test scenarios that should fail, such as an underwriter attempting to access restricted claims information. Both sets of tests are executed directly against the live enforcement layer. If authorized scenarios fail or unauthorized scenarios manage to succeed, it immediately signals a mismatch between configuration and policy.
Composable Open Source Building Blocks
The broader technology industry already possesses many of the essential pieces required to implement this comprehensive approach, though they have not yet been fully integrated into a turnkey commercial solution. Agent runtimes now provide robust execution environments; for instance, OpenShell offers sandboxed execution paired with identity integration and credential scoping, while platforms like OpenClaw are evolving to provide orchestration frameworks capable of coordinating multiple agents under pluggable security policies.
Meanwhile, policy frameworks handle extraction and evaluation. Tools like Asago, an open source framework designed for policy-driven agent security, facilitate policy extraction from natural language governance documents and automate scenario generation for validation testing. Standardized protocols like MCP govern agent-tool interactions, while established testing frameworks such as Garak and evaluation automation utilities like EvalHub streamline security red-teaming.
These components are inherently composable. While no single utility solves the entire security puzzle on its own, the necessary building blocks are readily available in the open source ecosystem. What the enterprise technology sector requires now is collaborative effort to chain these components together, standardize the interfaces between them, and establish reliable reference implementations that organizations can confidently adopt.
Real-World Testing and Validation
To demonstrate the viability of this methodology, engineering teams recently tested and extended the Asago framework to evaluate a policy-driven data access workflow for a read-only, retrieval-augmented insurance assistant. The assistant was designed to serve users holding distinct professional responsibilities through a single shared chat interface. Under this setup, an underwriter was permitted to retrieve underwriting guidance and property-risk information, but was strictly barred from retrieving sensitive claims data. Conversely, a compliance reviewer was authorized to retrieve information from both domains for necessary oversight and auditing.
The testing process began with a foundational governance policy alongside a concise textual description of the assistant’s operational role, underlying data sources, and expected access boundaries. Asago leveraged these inputs to automatically identify relevant security risks and generate harmful scenarios that violated organizational boundaries, thereby informing the agent’s access policies.
When the engineering team tested a deliberate cross-domain request from an underwriter in a baseline configuration, the assistant improperly returned claims information alongside permitted underwriting content. The evaluation workflow immediately flagged this behavior as a policy violation. Subsequently, a permission recommender utilized the policy-derived artifacts, evaluation findings, and deployed data-asset configurations to propose precise permission modifications for the data discovery and retrieval layers—implemented in this proof of concept using a data registry for asset discovery and Feast for data retrieval.
After applying the recommended permissions, the evaluation workflow was rerun. The underwriter was still able to retrieve necessary underwriting information, but the unauthorized claims retrieval was successfully denied, while the compliance reviewer retained authorized access to both domains. The successful demonstration proved that policy-driven testing can effectively identify hidden data-access gaps, drive reviewable configuration changes, and verify intended system behavior following remediation.
Implications for Data, Security, and Platform Teams
For enterprise data leaders, adopting this policy-driven approach offers a clear pathway from reactive data governance to proactive security management. Instead of discovering dangerous access violations long after the fact through routine audits or security incidents, organizations can validate that runtime behavior strictly aligns with governance documentation before agents are ever cleared for production. Because policy changes automatically trigger the regeneration and revalidation of enforcement configurations, organizational governance becomes a continuous, living process rather than a periodic chore.
For security professionals, this methodology significantly reduces the corporate attack surface. Over-permissioned AI agents represent a massive vector for enterprise risk because an agent equipped with unrestricted access to all data repositories can potentially be manipulated via prompt injection to exfiltrate sensitive information. Restricting an agent’s access strictly to its designated role limits the potential blast radius of a successful security compromise, while continuous automated boundary testing ensures those boundaries hold firm over time. Furthermore, comprehensive audit trails connect every single instance of data access directly back to a specific user role, operational task, and governance policy.
For platform engineering teams, the open source nature of these modular building blocks prevents vendor lock-in, allowing organizations to adopt security components incrementally. Enterprises can begin by introducing policy extraction from governance documents, later incorporating scenario generation for validation testing, and eventually integrating these capabilities with existing authorization engines.
As organizations navigate the rapid acceleration of agentic AI, Red Hat continues to participate actively within this collaborative ecosystem alongside the Asago and MCP communities, OpenShell, and the Open Agent Safety Platform. By exploring how platforms like Red Hat OpenShift AI can surface policy-driven access controls for complex agent workloads, the focus remains firmly on contributing to open standards and community tooling, ensuring that advanced agent security remains accessible to enterprises across the globe.
No comments yet. Be the first to join the conversation!