AI Agents Reach Enterprise Data With Permission

What an AI agent can do

An enterprise AI agent can:

• Query enterprise data
• Search documents and knowledge sources
• Use APIs and applications
• Run analysis
• Work with other agents
• Take action under defined conditions

What makes agents powerful also raises a new enterprise requirement.

Which agent, acting for which user, can reach which data — and perform which operation?

What is an AI agent?

An AI agent is an AI system that can gather information towards a goal, form decision steps, use tools and carry out operations within set bounds.

In a classic LLM application the flow is usually User → Prompt → LLM → Response. In agent-based systems the process widens:

The difference matters. A chatbot mostly produces information; an agent reaches information and interacts with enterprise systems as well.

So as agents spread, AI security stops being only a question of model safety and becomes a question of enterprise access control too.

What is AI agent governance?

AI agent governance is the set of policy and control mechanisms that decide which resources an agent may reach inside the organization, which tools it may use and which operations it may perform.

For an enterprise agent, at least four questions have to be answered:

An agent does not inherit the user's permissions

User authorization has been part of enterprise applications for a long time. AI agents add a new actor to the system: the architecture can now hold two identities, user identity and agent identity.

A finance manager may well have permission to reach financial data. That does not mean every AI agent they use should automatically be able to do anything with it.

In an enterprise agent architecture the access decision can therefore weigh user, agent, resource, action and context together:

Same user, same agent; the decision changes with the resource and the action.

The aim is not to hand the agent every permission the user holds, but to give it the least it needs to do its job.

The resources agents reach

The resources an enterprise AI agent can reach are not only documents. An agent may interact with:

• Data lakehouse
• Data warehouse
• Operational databases
• Enterprise RAG
• Document systems
• ERP / CRM
• APIs
• Business applications
• Machine learning models
• Other AI agents

Agent governance is therefore not a problem that can be solved in the LLM layer alone. Authorization policy has to carry through to the data and to the tools in use.

The data layer agents query: the lakehouse →

AI agents and enterprise RAG

Enterprise RAG is one of the mechanisms an agent can use to reach enterprise knowledge. But RAG and agents are not the same thing.

RAG finds the relevant information and gives the model context. An AI agent uses that information, can choose tools, can interact with different systems and can carry out a task.

A procurement agent, for instance, might review contracts through enterprise RAG, query past purchasing data from the data platform, run a price comparison and raise a draft purchase request through an API the organization has defined.

In that scenario RAG is only one of the tools the agent uses.

More on enterprise RAG →

Data authorization in agentic AI

When an agent queries an enterprise data source, it matters that access control is applied at the retrieval or query stage.

Rather than handing the agent all the data and then asking the LLM not to show it, the aim is for data the agent is not authorized to see never to enter the retrieval result at all.

This matters most where sensitive enterprise data is used in AI systems.

Least privilege: only as much as the agent needs

One classic information-security principle matters particularly here: least privilege. An agent should reach only the data and tools it needs to carry out its task.

A sales-analysis agent may need to read customer and sales data, but it probably has no need to delete a customer record in the ERP. A finance agent may be able to analyse invoice data, while making a payment requires further authorization or human approval.

Agent permissions must cover not only what it can reach, but which action it can take.

Human in the loop

Not every agent action has to be fully autonomous. Depending on the level of risk, some operations can run automatically while others are tied to human approval.

This lets agents spread through the organization under control. The question is less whether an agent is autonomous than which operation may run under which control.

Agent activity and audit

Access control alone is not enough for an enterprise agent system; what the agent did has to be observable.

Depending on the organization, the following can be recorded:

• Which agent ran
• On whose behalf it ran
• Which resources it reached
• Which tools it used
• Which actions it performed
• Which policy decisions were applied

These records serve operations, security and audit.

Governance in multi-agent systems

Where several agents work together, authorization grows more involved. Each agent may reach different data sources and different tools.

One agent calling another must not mean the called agent's permissions pass automatically to the first. Each agent should work within its own identity, permissions, tools and policies.

Agent governance therefore becomes one of the foundational infrastructure components of multi-agent architectures.

AI agent governance with Kauzas

The Kauzas AI Platform treats agents as part of the enterprise Data & AI infrastructure. Controlled agent architectures can be built in the Kauzas ecosystem:

Used together with the Kauzas Data Platform, agents can work against the enterprise data lakehouse, catalog, metadata and governance layers.

Organizations can therefore build not just agents but an AI infrastructure that governs which data and systems those agents work with, and under which policies.

Explore the Kauzas AI Platform →

On-premise AI agents

Infrastructure is the other dimension of agent governance. The components an agent uses can, in the right architecture, run on infrastructure the organization controls:

• The LLM
• RAG
• Enterprise data
• Tool services
• Other AI components

Its Kubernetes-based architecture means Kauzas supports running AI and agent workloads on-premise, in a private cloud and in suitable cloud environments.

Organizations can therefore control not only what an agent is permitted to do, but where the data and AI services it uses actually run.

More on the on-premise AI platform →

The enterprise AI agent architecture

Every layer together:

Every agent request is weighed against identity and policy before it reaches data or a tool.

Frequently asked questions

What is AI agent governance?

AI agent governance is the set of policy, authorization and monitoring mechanisms that decide which data sources, tools and systems AI agents may reach, and which operations they may perform.

What is the difference between an AI agent and a chatbot?

A chatbot mostly produces a response to user input. An AI agent reaches information and can also use tools, interact with systems and carry out defined tasks.

What is the difference between an AI agent and RAG?

RAG is an approach to information retrieval. An AI agent can carry out a task using a range of tools and systems, RAG among them.

Should an AI agent inherit all of the user's permissions?

Giving agents the least they need to carry out their task is usually the more controlled approach. Agent and user permissions can be treated as separate policy layers.

Can AI agents run on-premise?

Yes. As long as the models, agent frameworks and other components support it, the agent infrastructure can run in the organization's own environment.

Can an agent's operations be audited?

When the agent architecture is designed with suitable telemetry and audit mechanisms, the tools it called, the resources it reached and the operations it performed can all be recorded.