Data Intelligence Determines What AI Agents Can Be Trusted To Reach

Security and data teams are connecting AI agents to the databases, warehouses, and file shares the business already runs on. An agent reads whatever those stores hold, cataloged or not. A company can govern only the data it can account for, so that data has to be classified before the policy is written.

Itay Kozuch is Chief Information Security Officer at Navan. A veteran security executive, he previously served as Senior Director of Security at ZoomInfo where he led security engineering, architecture, red team, and the global AI security program, he served as CISO at Outseer and CISO at Cellebrite. His expertise spans modern enterprise defense, AI security governance, and scaling security and compliance architectures across hyper-growth tech environments.

"If you don't know what data you have in your organization and where it sits, you'll have a problem governing it. If you have a good data security program, you'll know exactly what to connect, what not to connect, and in which cases to give access to customer data," says Kozuch. At Navan, an agent runs on the token of the person who built it, so its reach is bounded by that person's access before any policy is written. How far enforcement travels past that depends on the organization's maturity, where security is positioned, and how deep the company is willing to go.

Defining what AI may use

Before an agent touches customer data, somebody has to decide whether the company allows it, and what has to change to make it usable. Kozuch wants that decision made before the engineering starts. "What data is allowed to be shared with models, or can be handled with AI? This needs to be defined," he says.

Kozuch puts classification ahead of the AI question, so answers are ready when it arrives. Without it, a security team has to go back to the data teams to work out where anything lives. "A mature security team understands where the data sits and what kind of data, and they already have the classification. Those two efforts need to run together," he says. "Eventually you want to give them access to data, but if you don't know which data, where the data is, and how sensitive that data is, it's going to be really hard to do one without the other."

The limits of classification

Kozuch warns that a classification exercise covers only the systems it examined. Sensitive data gets copied into places it missed, and an agent drawing on several sources at once can reach those copies as readily as the originals. "If you don't have those programs in place, you'll need to work pretty hard with the data teams to understand where exactly your data is," he says. "You'll find copies of the data almost anywhere."

A team can also miss what sits inside the databases it uses every day, and a catalog that names all of them still says nothing about their contents. Kozuch grades each integration separately and then weighs them together, since grants that each look defensible can combine into access he'd refuse. He can't make that call without knowing what is in each source. "We have a central database and we're using it, but you may have no clue what data is inside or what it looks like," he says.

Ownership, access, and runtime

Navan gives an agent the same boundary it sets for an employee. A request to wire Workday into AI cleared only after Kozuch capped the agent at its builder's own access. His own ceiling is his group's salary data, and anything he built would stop there too. "In most organizations, the security team is restricting access to sensitive data, because not everybody needs that. So you build processes like just-in-time access, and you can do the same for agents," he says. "The fact that it's an agent and not a person doesn't mean anything."

Answering who may reach what depends on knowing the data first, since an access decision without it is a guess. Kozuch's list continues well past the data. He expects most companies to need more tooling before they can tell one agent apart from another. He would also put the agent through the same quarterly check every other identity gets, trimming whatever goes unused. "From a security standpoint, we look at ownership, authentication, authorization, what's allowed, what's not allowed, where this data can go, and how we secure agents at runtime," he says.

Kozuch tells anyone starting an AI governance program to get data security working first. He has found that running both at once is close to impossible. "A data security program is essential if you want to protect data. Without it, you'll literally go to war with a water pistol, because you have no idea what you're trying to protect or where it is," he concludes. "The organization is going to run way faster, so you need to be prepared."