As AI agents gain the ability to retrieve data and carry out actions across enterprise systems, their permissions, monitoring and incident-response controls need closer scrutiny. In this TNGlobal Q&A, we asked Carolyn Duby, Field CTO and Cybersecurity Lead at Cloudera, about practical ways to govern autonomous workflows across hybrid and multi-jurisdictional infrastructure.
AI agents can now query data, call tools and take actions across cloud, on-premises and hybrid environments. What changes in the security model when an identity is no longer just reading data but can autonomously decide what to do with it?
Traditional identity management asks, ‘Who is this user and what can they see?’ Agentic AI forces us to ask, ‘What can this identity actually do, and what is its maximum blast radius if it goes off script?
Access to data now comes with the ability to act on it. An agent can retrieve sensitive information, modify records and initiate workflows across connected systems at machine speed, potentially triggering consequences far beyond its intended task.
This demands a shift in how organizations assess security risk. Beyond determining what an agent can access, organizations must understand its potential blast radius: the systems, datasets and connected environments it could affect if compromised or operating unexpectedly. This requires security controls that account for how agents interact across the underlying data infrastructure.
Cloudera’s Great AI Re-Architecture survey found that 46% of Asia-Pacific respondents cite data security, governance and compliance as the leading driver of AI infrastructure change. As enterprises rethink their architectures, they must establish clear boundaries around agent autonomy, assess indirect access paths and incorporate containment mechanisms from the outset.
Zero-trust architectures traditionally focus heavily on authenticating a user or workload before access is granted. How should zero trust extend into continuous authorization once an AI agent is already operating inside an environment?
Zero Trust must extend from verifying an agent’s identity to continuously assessing whether its actions remain appropriate for the task it was authorized to perform. Even with legitimate credentials, an agent may execute unintended operations due to manipulated instructions, compromised context or unpredictable behavior. Authentication alone is no longer enough to establish whether those actions are safe.
Organizations should evaluate consequential actions against the agent’s assigned task, the sensitivity of the data involved and the potential impact. Higher-risk activities, such as exporting confidential records or modifying production systems, should require additional authorization or human approval. These checks should operate throughout the agent’s execution, with permissions reassessed when it moves between tools, datasets or environments. Automated policy enforcement can prevent unauthorized actions before they are completed, rather than relying solely on alerts after the fact.
What is the practical way to scope permissions for an agent that needs access to several datasets and systems to complete a task without simply giving it broad service-account privileges?
The starting point is to assign permissions according to individual tasks, instead of granting an agent standing access to every system it might eventually need. This requires enterprises to rethink their least privilege model, which traditionally limits users’ access rights to the minimum necessary.
Organizations must go beyond merely implementing policies on initial access and consider how to contain the potential consequences of unexpected agent behavior. This involves layered controls such as network segmentation, sandboxing, and tightly scoped API permissions. AI agents should also be issued transient identities, with elevated privileges granted only for the duration of a specific sub-task and revoked immediately upon completion.
For agents operating across multiple datasets and systems, enterprises should assess how permissions interact across connected environments to prevent agents from gaining indirect access to sensitive information beyond their intended scope.
Which runtime signals are most useful for identifying that an otherwise authorized agent is behaving unexpectedly, whether because of prompt injection, compromised context, a configuration error or another cause?
The most useful signals reveal deviations between what an agent was instructed to accomplish and what it is actually doing. Security teams should monitor unusual tool invocation patterns, unexpected access to sensitive datasets, repeated authorization failures, attempts to connect to unfamiliar endpoints and abnormal volumes of data retrieval or transfer.
Behavioral context matters equally. An agent that begins executing unrelated tasks, repeatedly attempts prohibited actions or changes its sequence of operations after consuming external content may warrant investigation, even if its credentials remain valid. Such deviations could indicate prompt injection, compromised context or configuration errors.
As suspicious behavior may emerge from a sequence of individually authorized actions, effective detection would require correlating an agent’s actions with its original objectives and permitted workflows.
If an agent begins acting outside its intended purpose, what should an enterprise be able to do immediately? How should revocation, isolation, rollback and preservation of the audit trail work in practice?
Enterprises need coordinated containment and recovery mechanisms that operate at machine speed. The immediate priority is to suspend the agent, revoke its credentials, block further API calls and isolate affected workloads to prevent harmful actions from spreading.
Where an agent has modified records or configurations, version histories and transaction logs should support recovery and rollback where technically possible. Organizations must also preserve tamper-resistant audit records covering agent instructions, tool calls, accessed resources and resulting actions to establish what occurred.
These safeguards should be tested through simulated incidents to ensure intervention mechanisms work across connected environments. Given the speed at which agents operate, critical containment actions should be automated, with human oversight supporting investigation and recovery.
APAC organizations often run data across several jurisdictions and infrastructure environments. How should they track data lineage and residency when an agent can retrieve, transform and combine information from multiple locations in a single workflow?
Organizations need end-to-end visibility into how agents access, process and combine data across environments. This means having the right data infrastructure in place to allow tracking original data sources, processing locations, transformations and resulting outputs, including when information crosses jurisdictional boundaries.
Consistent metadata, data classification and lineage tracking enable organizations to trace sensitive information throughout an agent’s workflow. Residency controls must also govern where data can be processed or transferred, beyond its original storage location. This is particularly important as enterprises increasingly adopt hybrid AI architectures. According to Cloudera’s Great AI Re-Architecture survey, 64% of APAC organizations had moved AI workloads from public cloud environments back to private cloud or on-premises infrastructure during the past year.
As data and AI workloads become increasingly distributed, organizations require governance policies that remain consistent across environments. Enterprises are turning to solutions such as Cloudera Anywhere Cloud to deliver unified governance across the data estate, maintaining complete visibility and enforcing policy engines globally while executing data residency checks locally.
Where should organizations standardize AI-agent governance regionally, and where do local privacy, sovereignty or sector rules make a market-specific approach unavoidable?
Enterprises should establish region-wide standards for agent identities, access permissions, data classification, audit logging, incident response and accountability. This provides consistent oversight across markets and infrastructure environments.
Local adaptation becomes necessary when agents process regulated data, transfer information across borders or operate in sectors with additional security obligations such as finance, healthcare and government. Privacy laws and sector-specific regulations may impose different constraints on where information can be accessed or retained. Cloudera’s survey found that 61% of APAC respondents reported greater difficulty maintaining effective data governance following AI integration, highlighting the challenge of applying consistent policies across increasingly complex environments.
A practical approach is to define enterprise-wide security policies centrally and enforce jurisdiction-specific restrictions through data and workload governance controls. This allows organizations to maintain a consistent security posture across hybrid environments while respecting the regulatory realities of individual markets.
What metrics would tell a security leader that controls for agentic AI are actually working? Which measures are more useful than simply counting blocked actions or security alerts?
Security leaders should evaluate agentic AI controls across three dimensions:
Prevention: The proportion of agents operating with least-privilege access, compliance with approved data policies and the percentage of high-risk actions requiring additional authorization.
Response: Time to detect abnormal behavior, revoke credentials and isolate affected workloads, measured through incident simulations.
Accountability: The ability to reconstruct agent actions, trace accessed data and identify affected systems through complete audit records.
The strongest indication of resilience is whether an organization can demonstrate that an agent’s autonomy remains controlled, its actions remain traceable and unexpected behavior can be contained before it causes significant harm.
Editor’s note: This Q&A has been lightly edited for clarity and TNGlobal house style. The substance of the interviewee’s responses has been preserved.
Share your perspective: TNGlobal welcomes contributed insights and expert commentary from across Asia’s technology and innovation ecosystem. Submit a contribution for editorial consideration, or explore more conversations in our TNGlobal INSIDER and TNGlobal Q&A and Interviews archive.
CARSOME’s Eric Cheng on building sustainable used-car unit economics [Q&A]