As AI becomes connected to enterprise-wide data analysis, workflow automation, and external system actions, organizations need to manage the data and systems each AI request can access or operate. What often begins as departmental document search can quickly extend to customer data, internal documents, business systems, and data held across subsidiaries.
A 2026 McKinsey analysis on cybersecurity challenges in the expansion of enterprise AI found that more AI systems are gaining access to enterprise infrastructure and data. Identity, governance, and data controls are becoming central security concerns as a result. Organizations need continuous visibility into the data and systems AI uses while carrying out work.
The National Institute of Standards and Technology, or NIST, has also outlined the identity and authorization controls needed when AI accesses enterprise data and business systems, including identification, authentication, authorization, revocation, least privilege, and execution records. As the scope of AI use expands, organizations need to know who accessed which data, under what authority, and what actions were performed.
The following cases illustrate security risks that can arise when access governance is not designed into an AI environment.
AI Exposes Data Outside the Intended Access Scope
In March 2026, an AI system at a global technology company provided an engineer with instructions for changing access controls. An employee applied the guidance to a live system. The change expanded the existing access model and exposed confidential company and user data to unrelated engineers for about two hours.
Access controls in an enterprise define the data a user can retrieve and the actions they can perform. Those permissions are determined by the user’s legal entity, organization, role, and responsibilities. When AI supports access configuration or system changes, it must account for the requester’s authority, the sensitivity of the affected data, and the users who could be affected.
Changes involving data access, external integrations, or deployment settings can affect multiple teams and systems. Before a change is carried out, the organization needs to verify that the requester has the required authority, that the affected scope is within their approved responsibilities, and that the action does not require an additional review or approval.
The execution record should also show who made the request and which setting changed. This helps security and operations teams assess how access boundaries changed and trace the scope of an incident quickly.
Prompt Injection Can Expand an AI System’s Data Access Scope
A security study published in April 2026 identified a path for sending sensitive business data to an external server through hidden instructions embedded in logs processed by Grafana’s AI features. The attacker placed instructions in a form that was not visible to ordinary users and induced the AI to interpret them as task instructions while summarizing logs.
The case showed that an AI system could call external resources unrelated to the requested log analysis, then pass results containing internal data to an external destination. A user may simply request a log summary or incident analysis, while instructions embedded in the retrieved content intervene in the execution flow.
This attack category is known as indirect prompt injection. Instructions can be hidden in emails, documents, webpages, collaboration comments, and system logs that an AI system processes during normal work. The system may fail to distinguish these instructions from the user’s request or system-level guidance.
AI systems should not treat every piece of retrieved content as a trusted task instruction. The data an AI system can retrieve and the external systems it can call should remain within the requesting user’s authorized scope. Actions with broad impact, including external transfers, file changes, approval requests, and system configuration changes, also need separate approval and execution checks.
AI May Continue Retrieving Data After Access Has Changed
A security advisory issued in June 2026 for an open-source container management platform found that users could retain revoked permissions because lower-level permission bindings were not removed after an administrator changed a role template. The outdated permissions remained even after the role changed and the associated binding was deleted.
The same pattern can occur in AI environments. An employee may transfer teams or move to another subsidiary, and their access rights may change accordingly. If an AI search index, cache, or automation retains prior permission information, the system can continue retrieving documents from the employee’s previous organization. Direct access may be blocked in the user interface, while AI responses still contain documents retrieved under the previous access model.
This gap appears when access changes and AI search permissions are managed separately. In RAG environments, documents are broken into chunks and indexed. A source document’s updated permissions may not be reflected in previously generated search data or cached content.
When a user’s access changes, existing credentials and permission context must be invalidated immediately. New permissions should apply to the next request. AI search, automation, and API integrations need to rely on the same authorization information so organizational and role changes propagate throughout the workflow.
AgentOS Applies the Same Access Standard to Users and AI
To address these risks, Enhans AgentOS applies the same authorization checks to users, AI, automation, and API requests.
When a user signs in, AgentOS issues a Passport based on their identity, role, tenant, and available features. That Passport travels with requests made through the UI and with tasks submitted to AI. AI data retrieval and task execution remain within the permissions of the user who initiated the request.
At the data access layer, AgentOS validates permissions by tenant, role, collection, object, row, and column. Collections and objects outside the user’s permissions are excluded from the retrieval scope.
When permissions change, the existing Passport is invalidated immediately. The next request is validated with a new Passport that reflects the updated permissions. The same authorization information applies across the UI, AI search, automation, and API requests, reducing the risk that a system retrieves data under a previous access model.
How Can Access Be Managed Across Subsidiaries?
In a group structure with a holding company and multiple subsidiaries, feature-level permissions alone do not provide enough control over data exposure. One user may hold a manager role at Subsidiary A while working under a limited member role at the holding company. Available data should vary by legal entity, role, and responsibilities.
Data for the enterprise and its subsidiaries is separated by tenant, an operating space for each legal entity or customer organization. Each tenant can have role-based feature permissions. Data access can be configured at the collection level, for groups of business data, the object level, for individual records, and down to rows and columns.
For example, an employee may be allowed to retrieve purchase order data while supplier contact names and unit-price columns remain restricted. Hidden columns are excluded from data lists and results. Masked columns remain visible as fields, but their values are unavailable. Row-level conditions can also restrict results to a defined legal entity, organization, or time period.
AgentOS can map user and group information from an organization’s existing SSO and identity management systems to role settings. When an employee changes teams or roles, updated permissions apply to the next sign-in and request. This gives each subsidiary and department access only to the business data required for its work.
Access Governance Sets the Operating Standard for Enterprise AI
As AI gains access to a broader range of enterprise data and systems, access governance affects security review, deployment speed, and audit readiness. Organizations need a consistent way to manage each user’s data scope and the actions available to them as AI is deployed across departments and subsidiaries.
In organizations where team and role changes are frequent, updated permissions must apply beyond the user interface. AI search, automation, API requests, and external system actions need to use the same current access information. When permission changes and authorization checks across these paths are managed separately, unauthorized documents can appear in responses and data from a previous team can remain retrievable.
AgentOS applies Passport-based authorization to data retrieval and task execution. Action execution records capture the actor, target, time, and completion status. Security teams can review access policies, business teams can use AI within their authorized scope, and operational owners can review execution outcomes.
in solving your problems with Enhans!
We'll contact you shortly!