Governing Agentic AI at Enterprise Speed: Why the Data Layer is the Unassailable Enforcement Point

Presented by EDB

As enterprises increasingly delegate significant autonomy to AI agents—systems designed to plan, decide, and act across various operational landscapes without requiring human approval for every single step—a critical and often complex question has ascended to the forefront of architectural reviews: What precisely prevents an autonomous agent from executing an action it was never authorized to perform? This isn’t a hypothetical concern but a pressing reality for organizations deploying advanced AI.

These sophisticated agents, powered by your proprietary models and interacting with your sensitive data within your infrastructure, operate under your ultimate responsibility. The onus for their actions, whether intended or unintended, rests squarely with the enterprise. This profound responsibility cannot be met retrospectively, nor can it be adequately addressed through abstract policy documents that exist merely on paper without practical enforcement. Instead, AI agents demand dynamic, context-aware rules that are applied precisely in the moment, primarily because these agents, by their very design, do not possess the capacity for overriding judgment regarding the appropriateness or consequences of their own actions.

Consider a seemingly straightforward directive: "Never open the car door." Interpreted literally, an AI agent adhering strictly to this rule would be unable to enter or exit a vehicle under any circumstances. However, if the situational context changes dramatically—for instance, if the car has just been involved in a crash, a fire has erupted, and an injured occupant desperately needs to escape—the desired rule immediately reverses. In such critical moments, the imperative is not to keep the door closed, but to open it. This vivid example underscores a fundamental truth: context in the moment is paramount. For AI agents to perform intelligent tasks, they necessitate intelligent rules – rules that are adaptable, nuanced, and sensitive to real-time conditions.

The initial, intuitive response to this governance challenge often involves layering "guardrails" around the agent itself. This typically manifests as a combination of instructions, high-level policies, and continuous monitoring mechanisms positioned above the core AI model. While these protective mechanisms undoubtedly hold value and contribute to a multi-layered security posture, they inherently share a significant structural limitation. The "car door" rule, for example, appears perfectly sound until the exact instant a decision must be made regarding whether to open the door. Controls implemented at the agent layer are only as reliable as the agent’s output is predictable. Yet, autonomy is precisely the characteristic that renders an agent’s output inherently difficult to predict with absolute certainty. Furthermore, a governance model that relies on human review and approval of every action before it occurs is fundamentally incapable of keeping pace with a system designed to act in milliseconds, often across numerous interconnected systems simultaneously. The sheer speed and scale of agentic operations render traditional, human-centric pre-action governance impractical and ineffective.

Therefore, the paradigm of governance must evolve from being merely prescriptive to becoming executable. This means that control mechanisms must be actively enforced precisely where agents perform their work: at the operational data layer, within the specific context of the action, and exactly at the moment that action is transpiring.

The Data Layer: The Ultimate Enforcement Point for AI Governance

AI agents generate value primarily through their interaction with data. They query databases, retrieve information, transform raw data, and, with increasing frequency, initiate actions based on that data. Consequently, a policy stating that an agent should not access a certain classification of data only carries true meaning if the underlying system possesses the capability to unequivocally deny that access the very instant the agent makes the request. Similarly, the principle that all AI operations must be auditable is only meaningful if the organization can comprehensively reconstruct the agent’s activity: precisely what the agent did, which specific data it accessed or modified, which human user or system it was acting on behalf of, and what the ultimate outcome of its actions was. When governance is embedded directly at the data layer, it maintains its integrity and enforceability irrespective of how the agent was constructed, its internal logic, or its behavioral nuances. This is because the control mechanism becomes an intrinsic property of the database system itself, rather than merely a promise or a probabilistic outcome dependent on the agent’s internal compliance.

Agent Behavior May Be Probabilistic; Governance Cannot Be

A critical distinction must be made: the enterprise cannot afford to rely on an AI model choosing to adhere to a policy. The policy must be enforced by the robust mechanisms of the system. This fundamental difference separates the precarious hope that an actor will voluntarily remain within predefined boundaries from the certainty of constructing boundaries that an actor, by design, simply cannot cross.

The practical controls that bring this robust enforcement to life are, in many cases, mechanisms that numerous enterprises already utilize at the data layer for human users and traditional applications. These include:

• Role-Based Access Control (RBAC): Granting or denying access based on the assigned role of the agent.
• Attribute-Based Access Control (ABAC): More granular control based on specific attributes of the agent, the data, or the environment.
• Row-Level Security (RLS): Restricting an agent’s access to specific rows within a database table.
• Column-Level Security (CLS): Limiting an agent’s visibility or modification rights to particular columns within a table.
• Data Classification and Masking: Automatically identifying sensitive data and obscuring it from unauthorized agents.
• Policy as Code: Defining governance rules in a machine-readable, executable format.
• Complete Audit Trails: Comprehensive logging of all agent interactions with data.

What AI agents fundamentally change is not the mechanism of these controls, but who or what these mechanisms must recognize and respond to. Identity management systems must evolve to treat the AI agent as a principal entity in its own right, endowed with its unique identity and a clearly declared purpose established at the inception of its operational session.

Once this declared purpose is inextricably bound to the agent’s identity, the existing policy engine can evaluate it with the same rigor and precision it currently applies to a user’s role or department. Consequently, the audit record of any action can capture not only who (or what agent) acted and what data they accessed, but also what they declared they were there to do. This contextual information is invaluable for both real-time enforcement and post-incident analysis.

In practical application, this sophisticated approach resolves into a comprehensive set of controls, effectively grouped under three overarching imperatives:

• Enforce it: Ensuring that policies are actively and automatically applied at the point of data interaction, preventing unauthorized actions before they occur. This involves leveraging granular access controls like RBAC, ABAC, RLS, CLS, and data masking to create impenetrable boundaries.
• See it and prove it: Establishing complete transparency and accountability for all agent actions. This requires meticulous and immutable audit trails that capture every interaction, allowing for full reconstruction of events and demonstrable compliance with regulatory and internal standards.
• Unify and harden: Integrating governance across the entire data ecosystem and fortifying defenses against evolving threats and complex agent behaviors. This includes the application of policy as code for consistency and the continuous strengthening of the data layer itself.

Priyanka Jain, VP, Product Management, Data & AI Governance at EDB, emphasizes the transformative role of contextual information: "Declared purpose is what makes the difference. It becomes an attribute the access layer already understands, evaluated in the same policy path as role and row-level security. The enforcement mechanism does not change. What changes is that the agent’s purpose is part of what it evaluates, and part of what the record proves afterward." This highlights the seamless integration of agent-specific governance within existing, proven data security frameworks.

Regardless of an enterprise’s current stage in its AI adoption journey, implementing enforcement directly at the data layer provides a powerful accelerator rather than a brake. The necessary controls are, in essence, already resident within the database infrastructure. The fundamental shift is that AI agents must now explicitly pass through and adhere to these established gates.

A Digital Leash, Not a Locked Door

The overarching objective of this data-layer governance strategy is not to impede AI agents from performing valuable and productive work. Rather, it is to precisely define the operational scope of an agent, delineate what data it can access and modify, specify actions that necessitate escalation to human oversight, and establish robust mechanisms for reconstructing events if any anomaly or malfunction occurs. Governed in this comprehensive manner, AI agents are clearly identified, their operational scope is meticulously defined, their activities are continuously monitored, and their actions are fully auditable. This foundational trust in the operating model empowers the enterprise to adopt and deploy AI agents faster and with greater confidence, secure in the knowledge that security, risk management, and leadership teams have verified the underlying integrity.

Open, Sovereign, and Enforceable at the Source

EDB’s approach, epitomized by EDB Postgres AI, is built upon the robust foundation of open source Postgres. This commitment to an open foundation ensures that enterprises retain absolute control over the physical location of their data, precisely who can access it, and under what specific policy conditions. Crucially, it prevents organizations from ceding critical governance authority to proprietary layers that they neither own nor can thoroughly inspect. For industries operating under stringent regulatory frameworks, this powerful combination of data sovereignty—maintaining complete control and jurisdiction over data—and source-level enforcement is not merely a desirable feature; it is an absolute precondition for successfully deploying AI agents into production environments.

Agentic systems are undeniably destined to become even more capable, sophisticated, and autonomous. This ongoing evolution serves as a compelling reason to be exceptionally deliberate and strategic about where control and governance mechanisms reside, rather than a justification for slowing down AI innovation. Enterprises that proactively implement and enforce governance at the data layer are uniquely positioned to move forward aggressively with their AI initiatives, confident in the knowledge that the fundamental protection of their invaluable data is built upon verifiable reality, not merely wishful thinking.

EDB Postgres AI represents an open, enterprise-grade sovereign data and AI platform meticulously engineered to unify transactional, analytical, and AI workloads – with governance unequivocally enforced precisely where the data resides. For a more exhaustive understanding of this comprehensive framework, enterprises are encouraged to consult EDB’s detailed white paper, Governing Agentic AI at Enterprise Speed.

Max Romanenko is the Chief Technology Officer at EDB.

Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they’re always clearly marked. For more information, contact [email protected].