Executive Snapshot

Data security for AI agents is no longer just a question of whether employees may enter confidential text into a chatbot. Agents connect to files and systems, retrieve content, act through tools, and build responses from several sources. Recent OWASP agentic guidance names risks involving goals, tools, identity, and privilege; platform documentation increasingly distinguishes document retrieval from user authorization. [1] [2] [3] [4]

The leadership question is practical: do access decisions remain valid when information moves from its original system into agent context and then to a user or action? The five developments below offer a way to organize an evidence-led discussion without assuming that every connected agent has a defect.

Agent Risk Models Now Include Identity and Tool Scope

OWASP’s Top 10 for Agentic Applications for 2026, published in December 2025, addresses agent goal hijack, tool misuse, and identity or privilege abuse. [1] This is a threat-and-mitigation framework, not an industry breach count. For security leaders, it encourages a move from asking only whether the response is accurate to asking what the agent can access and do. A helpful permission question is: could this agent complete the approved task with fewer tools or narrower data access?

Search Permission Is Becoming More Explicit

Microsoft documents document-level controls for Azure AI Search, including a string-based security filter and newer identity-aware permission features. Several native approaches are marked preview and therefore should not be described as universally production-ready. [2] The strategic lesson is that indexing a file and serving its text are separate decisions. Teams should verify how permission metadata is created, refreshed, interpreted, and evaluated for each query.

Sensitive-Text Filters Have Important Blind Spots

Amazon Bedrock Guardrails documents filtering for personally identifiable information in prompts and responses, but explicitly notes that its sensitive-information filter does not evaluate tool-call arguments or tool results in specified API contexts. [3] That detail matters because agents often move information through tools. A safe design checks exactly which request and response surfaces are covered, and assigns other controls where the feature does not apply.

Untrusted Documents Need Defense in Depth

Microsoft’s published defense pattern for indirect prompt injection describes a layered approach involving controls on outside content, short-lived or limited privileges, monitoring, and human checks for consequential actions. [4] None is presented here as an absolute guarantee. A leadership team can ask for evidence that retrieved documents are treated as content rather than instructions and that a malicious sentence inside a source cannot simply authorize a file export.

Governance Needs Measures That Reflect Actual Use

The NIST AI Risk Management Framework provides voluntary guidance, and NIST’s 2024 Generative AI Profile adds generative-AI-specific considerations; NIST also reported continued AI RMF work in 2026. [5] The value for a business leader is a common decision language: document the use case, identify affected data, measure behavior in permitted and denied cases, and improve controls when integrations or data access change.

CyberTech Intelligence Perspective

An agent is not entitled to a document merely because it can retrieve it, and an output filter does not necessarily govern every tool action. CyberTech Intelligence recommends reviewing identity, source permission, retrieval, sensitive context, and downstream action as one joined operating question. Keep what a provider documents separate from what your organization has actually tested.

Five Questions for the Next Leadership Review

• Which agent tasks require confidential documents, and who approves the source list?

• Can the team demonstrate one authorized retrieval and one properly denied retrieval?

• Which sensitive information checks apply to user input, agent context, tool calls, and final responses?

• How are untrusted document instructions prevented from changing tool permissions or approval rules?

• What policy or connector change automatically prompts a new data-access review?

Explore the Full Evidence Model

Use these five questions to frame a conversation with your data, identity, and AI owners. For deeper definitions and evidence categories, continue to the CyberTech Intelligence Research Report for CTI - Data - 26-10-004 rather than drawing conclusions from a vendor feature alone.

About CyberTech Intelligence

CyberTech Intelligence provides research-led cybersecurity intelligence, executive content, and market engagement programs. This publication is vendor-neutral and intended for education, decision support, and evidence-aware security planning.

Evidence and Citation Note

Public standards and industry guidance inform the control principles discussed here. Vendor documentation is evidence of a described feature or product limitation, not evidence of a specific customer configuration. Illustrative scenarios and CyberTech Intelligence frameworks are analytical models, not findings about a named organization, incident statements, certifications, breach predictions, or guaranteed outcomes.

References

  1. OWASP Gen AI Security Project, “OWASP Top 10 for Agentic Applications for 2026.” December 2025 risk framework for agentic AI, distinct from proof of any company incident. https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/
  2. Microsoft Learn, “Document-level access control in Azure AI Search.” Current documentation distinguishes security filtering and newer preview identity-aware controls. https://learn.microsoft.com/en-us/azure/search/search-document-level-access-overview 
  3. Amazon Web Services, “Remove PII using sensitive information filters, Amazon Bedrock.” Current feature reference explains probabilistic detection and exclusions for tool arguments and tool results. https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html 
  4. Microsoft Learn, “Defend against indirect prompt injection attacks.” Current Microsoft Zero Trust design guidance advocates layered controls for untrusted content. https://learn.microsoft.com/en-us/security/zero-trust/sfi/defend-indirect-prompt-injection 
  5. NIST, “AI Risk Management Framework.” Maintained program page describes the 2024 GAI profile and an April 2026 critical-infrastructure concept note. https://www.nist.gov/itl/ai-risk-management-framework