BigID, the leader in data security and AI governance, announced Agentic Access Control and Intent-Based Activity Monitoring. The two capabilities answer the question dominating hallway conversations at Black Hat this year: once an agent has access to your data, what actually stops it from doing something you never approved?
Permissions were built for people. Agents don’t act like people.
Role-based access control assumes a human is behind every request: someone who logs in, clicks around, and occasionally asks for more access. Agents don’t work that way. They act at machine speed, chain tasks across systems on their own, and can drift from their original purpose long before anyone notices.
That leaves two blind spots most security teams haven’t closed:
- No policy layer built for agents. Access is still granted the way it’s always been granted: broad roles, standing credentials, rarely revisited.
- No visibility into what agents actually do. Even with the right access in place, few teams can say with confidence what an agent did with it, or whether those actions matched the task it was given.
Govern the access. Then watch the behavior.
BigID‘s new capabilities close both gaps, together.
Also Read: d-Matrix Acquires Wallaroo.ai to Speed up Deployment of Heterogeneous AI Inference Workloads
Agentic Access Control is a policy layer purpose-built for AI agents:
- Scopes what an agent can touch based on the sensitivity of the data itself, not just a role or a credential
- Adjusts access dynamically as an agent’s task changes, instead of granting one broad permission set upfront
- Runs every authorization decision through BigID’s data intelligence, so access always maps to what the data actually is
Intent-Based Activity Monitoring watches what happens after access is granted:
- Establishes what an agent is supposed to be doing, then checks its actual behavior against that intent, continuously
- Flags actions that stray from intent, even when they’re technically within permitted access
- Traces the full chain of what an agent read, moved, or acted on, tied directly to the sensitivity of the data involved
Together, they form what BigID calls an authority layer: one system of record for what an agent is allowed to do, what it says it’s trying to do, and what it’s actually doing, all grounded in the data.
“Every agent you deploy inherits a level of trust. The real question is whether you can verify that trust is earned continuously, not just granted once at setup.” – Nimrod Vax, Co-Founder & Head of Product, BigID.
SOURCE: PRNewswire