AI agents are moving from assisted tools toward systems that can plan, decide and act across enterprise environments. That shift creates a practical governance problem: when an agent tries to do something outside its authority, the organization needs a control that can stop the action immediately.
The central argument is simple. Policies written for people, or guardrails placed only around a model, are not enough when autonomous systems are working across data and applications at high speed. For agentic AI, governance has to be executable, contextual and enforced where the work actually happens: the operational data layer.
Autonomy changes the governance question
Traditional AI governance often focuses on instructions, oversight and monitoring. Those tools still matter, but they do not fully answer the harder problem raised by autonomous agents. An agent may be running on the company’s models, inside the company’s infrastructure and against the company’s data, yet still make a request that should not be allowed.
That is why the relevant question is not only whether the agent was told what to do. It is whether the system can enforce limits at the exact point of action. If an agent asks for data it should not see, governance must be able to deny the request when it is made.
The source uses a car-door example to explain why rigid rules can fail without context. A rule such as never opening the car door can sound sensible in one situation, but the correct action may change if the car has crashed, there is a fire or someone needs help getting out. The lesson for AI agents is that useful rules must be evaluated in context, not treated as static slogans.
Why the data layer becomes the control point
Agents create business value by working with data. They query it, retrieve it, transform it and increasingly act on it. That makes the database and surrounding operational data layer the natural place to enforce boundaries.
A policy saying an agent should not access a certain class of data only matters if access can be blocked when the request occurs. A principle saying AI must be auditable only matters if the organization can later reconstruct what happened, which data was involved, which user the agent acted for and what result followed.
This is the difference between relying on agent behavior and relying on system enforcement. Agent behavior can be unpredictable because autonomy is part of the design. Governance, by contrast, has to be deterministic enough for security, risk and leadership teams to trust.
When control lives in the data layer, it does not depend on how a specific agent was built or how it phrases a request. The database can enforce policy as a property of the system. That makes governance less about hoping an agent follows the rules and more about defining boundaries the agent cannot cross.
The familiar controls now need to recognize agents
The source does not present agent governance as a completely new security stack. Instead, it points to controls many enterprises already use at the data layer: role- and attribute-based access, row- and column-level security, classification and masking, policy as code and complete audit trails.
What changes is who those controls must understand. An AI agent has to be treated as a principal with its own identity. It also needs a declared purpose when a session begins, while preserving the user on whose behalf it is acting.
Once purpose is attached to identity, it becomes another attribute the policy engine can evaluate. The system can then decide whether the agent’s role, the acting user, the declared purpose and the requested data fit the rules that apply at that moment.
“Declared purpose is what makes the difference. It becomes an attribute the access layer already understands, evaluated in the same policy path as role and row-level security. The enforcement mechanism does not change. What changes is that the agent's purpose is part of what it evaluates, and part of what the record proves afterward,” says Priyanka Jain, VP, product management, data & AI governance, EDB.
Nine controls define the operating model
The framework described in the source resolves into nine controls, organized under three imperatives. Together, they describe how enterprises can identify agents, limit access, protect data and preserve evidence of what happened.
- Role- and attribute-based access control enforced at query time, for agents as well as users.
- Dynamic column masking driven by the same policy path.
- Agent identity as a first-class principal, with declared purpose bound at session start and the acting user preserved.
- Classification and tagging that drives policy.
- Session-level audit logging that records which agent acted, for which user, and under what declared purpose.
- Lineage across pipelines, so a result can be traced back to the request that produced it.
- Centralized, portable policy management.
- Encryption at rest and in transit.
- Consistent enforcement across on-prem, cloud, and sovereign or air-gapped environments.
The value of this model is that it gives agents room to operate without giving them open-ended reach. The goal is not to block useful work. It is to define what an agent can access, what it can change, where escalation is required and how the enterprise can investigate if something goes wrong.
Production AI depends on enforceable trust
For regulated industries, the source frames data sovereignty and source-level enforcement as prerequisites for putting agents into production. The reason is straightforward: enterprises need to know where data lives, who can reach it and under which policy decisions access is granted or denied.
The article also connects this approach to an open foundation built on open source Postgres. In that model, governance remains closer to the systems the enterprise owns and can inspect, instead of being delegated entirely to a layer outside its control.
As agentic systems become more capable and more autonomous, the argument is not that companies should slow adoption. It is that they should be deliberate about where control is enforced. If governance is embedded in the data layer, agents can move quickly while still being identified, scoped, monitored and auditable.
That is the core future-facing point for enterprise AI. Autonomy increases the value of agents, but it also raises the cost of weak controls. The organizations that can enforce AI governance at the data layer will be better positioned to use agents in production because their trust model is built into the place where the data actually lives.