As enterprises grant AI agents greater autonomy—the ability to plan, decide, and act across systems without human approval at each step—a critical question emerges in every architecture review: What actually stops an agent from completing an action it was never authorized to perform?
These agents run on your models, touch your data, and operate within your infrastructure. The responsibility for their actions rests with you. That responsibility cannot be fulfilled after the fact or through abstract policies that exist only on paper. Agents need rules that apply in the context of the moment, because they do not exercise independent judgment about their own actions.
Consider a simple rule: Never open the car door. Followed literally, an agent could never enter or exit the car. But if the context changes—a crash, a fire, someone injured needing escape—the rule you actually want is the opposite. Context in the moment is everything. We ask agents to perform intelligent tasks; that requires intelligent rules.
Why Agent-Layer Guardrails Fall Short
The natural instinct is to add guardrails around the agent: instructions, policies, and monitoring layered above the model. These mechanisms matter, but they share a structural limitation. The car-door rule seems sensible until the moment you must decide whether to open the door. Controls at the agent layer are only as reliable as the agent’s output is predictable—and autonomy is precisely what makes that output unpredictable. Governance that depends on reviewing an action before it occurs cannot keep pace with a system that acts in milliseconds across multiple systems simultaneously.
Governance must become executable and enforced where agents actually perform their work: at the operational data layer, in context, and exactly at the moment of action.
The Data Layer as the Enforcement Point
Agents create value by touching data—querying, retrieving, transforming, and increasingly acting on it. A policy that an agent should not access a certain class of data is meaningful only if the system can deny that access at the moment the agent requests it. Similarly, a principle that AI must be auditable is meaningful only if the organization can reconstruct what the agent did, what data it touched, which user it acted for, and what resulted. When governance resides at the data layer, it holds regardless of how the agent was built or behaves, because the control is a property of the database itself—not a promise made by the agent.
Probabilistic Agents, Deterministic Governance
Agent behavior may be probabilistic, but governance cannot be. Enterprises should not rely on a model choosing to follow policy. The policy must be enforced by the system. This is the difference between hoping an actor stays within bounds and constructing bounds that cannot be crossed.
The controls that make this possible are ones many enterprises already run at the data layer: role- and attribute-based access, row- and column-level security, classification and masking, policy as code, and complete audit trails. What agents change is not the mechanism, but who the mechanism must recognize. Identity management must treat the agent as a principal in its own right, with its own identity and a declared purpose when the session opens. Once purpose is bound to identity, the policy engine can evaluate it the same way it evaluates role or department today. The record of what happened can then capture not just who acted and what they touched, but what they declared they were there to do.
Nine Controls Under Three Imperatives
In practice, this approach resolves into nine controls grouped under three imperatives:
Enforce It
- Role- and attribute-based access control enforced at query time, for agents as well as users
- Dynamic column masking driven by the same policy path
- Agent identity as a first-class principal, with declared purpose bound at session start and the acting user preserved
See It and Prove It
- Classification and tagging that drives policy
- Session-level audit logging that records which agent acted, for which user, and under what declared purpose
- Lineage across pipelines, so a result can be traced back to the request that produced it
Unify and Harden
- Centralized, portable policy management
- Encryption at rest and in transit
- Consistent enforcement across on-prem, cloud, and sovereign or air-gapped environments
“Declared purpose is what makes the difference. It becomes an attribute the access layer already understands, evaluated in the same policy path as role and row-level security. The enforcement mechanism does not change. What changes is that the agent’s purpose is part of what it evaluates, and part of what the record proves afterward,” says Priyanka Jain, VP of product management, data & AI governance at EDB.
A Digital Leash, Not a Locked Door
The goal is not to stop agents from doing useful work. It is to define how far an agent can go, what it can touch, what it can change, what requires escalation, and how the organization can reconstruct events if something goes wrong. Governed this way, agents are identified, scoped, monitored, and auditable. Enterprises can adopt them faster because security, risk, and leadership teams trust the operating model underneath.
Open, Sovereign, and Enforceable at the Source
Built on open source Postgres, this open foundation keeps enterprises in control of where their data lives, who can reach it, and under what policy—without ceding governance to a layer they don’t own or can’t inspect. For regulated industries, the combination of data sovereignty and source-level enforcement is not a nice-to-have; it’s the precondition for putting agents into production at all.
Agentic systems will continue to become more capable and more autonomous. That is a reason to be deliberate about where control lives, not a reason to slow down. Enterprises that enforce governance at the data layer can move aggressively on AI because the thing protecting their data is more than just wishful thinking.
EDB Postgres AI is an open, enterprise-grade sovereign data and AI platform that unifies transactional, analytical, and AI workloads—with governance enforced where the data lives. For the full framework, see EDB’s white paper, Governing Agentic AI at Enterprise Speed.
Max Romanenko is Chief Technology Officer at EDB.
