A regional manager and a corporate analyst can ask the same question—“How is channel conversion performing?”—and be entitled to different answers. Row-level filtering in the database is not enough if a cache, export, or shared report can later deliver the corporate result to the regional user.
Governance cannot be a system prompt that says “do not reveal sensitive information.” It must cover discovery, model context, tool invocation, runtime, delivery, and business actions, enforced by systems the model cannot override.
A model may explain policy, request approval, or present a denial. It cannot grant itself authority or override a rejection because the task seems important.
Map assets, principals, and trust boundaries
Protected assets include more than source tables: field descriptions, vector indexes, query results, caches, checkpoints, logs, charts, and downloaded files can all disclose data. Principals include the end user, agent service identity, data-platform identity, approver, recipient, and connector provider.
For every path, ask who initiated it, whom the call represents, what it reads or changes, for which purpose, where it runs, and who receives the output. Documents, web pages, database text, and messages from other agents are untrusted inputs. Entering context does not give them authority to call tools or change policy.
Identity must survive the whole call chain
Preserve the end user’s scope when possible. If a service identity is required, narrow it by tenant, domain, purpose, and action, and assign responsibility for enforcing user-level restrictions. A connector that can log in does not imply that every user may access its data.
Authorization input should include principal, tenant, resource, row and column scope, action, purpose, environment, risk class, and policy version. The policy service returns allow, deny, or approval required plus the effective scope. Credentials remain in the server-side runtime.
Microsoft Fabric Data Agent’s sharing documentation separates access to the agent from access to underlying data and preserves row- and column-level security. The general principle is useful: sharing an interface cannot substitute for source authorization.
Caches and artifacts are easy-to-miss exits
A cache key cannot consist only of the question text. Bind it to tenant, effective authorization, semantic version, data version, and policy version, and invalidate it on revocation. A cache hit still requires authorization; otherwise a corporate answer can leak to a regional user.
“The analyst can see it” does not mean “the recipient can receive it.” Reauthorize exports for the actual audience, including inference risks from small groups and aggregates. Remove restricted content rather than adding “confidential” to a filename. Error messages must not reveal hidden table, person, or field names.
Prompt injection and excessive agency are distinct
Prompt injection uses untrusted content to redirect the agent. Excessive agency means the system already exposes too many functions, permissions, or autonomous decisions. An agent with an unnecessary delete tool can cause damage without any injection.
OWASP’s prompt-injection guidance recommends defense in depth: isolate untrusted content, minimize privilege, process inputs and outputs, and require human confirmation for high-impact operations. Quoting a document or adding another detection model is not a security boundary. OWASP’s Excessive Agency guidance highlights excessive functionality, permission, and autonomy.
Separate read-only queries, writes, and external communication into different capabilities. Register only tools required for the task and constrain destinations and parameters. Detection supplies a signal; the tool gateway enforces the block.
Approval must bind to the actual action
An approver should not see only “optimize campaign strategy.” Present the target, parameters, data scope, recipient, evidence, expected effect, cost, rollback or compensation path, and expiration. A material change requires a new approval.
Revocation has concrete limits. Sent email and downloaded files may not be recoverable; cross-system actions may support compensation but not atomic rollback. Distinguish preventable, cancellable, reversible, compensatable, and irreversible operations.
Audit and incident response must stop real work
Audit links task, user, delegated identity, resources, policy, approval, parameter digest, execution ID, result, and recipients. Ordinary logs should avoid credentials and unnecessary sensitive text. High-risk records need access isolation, integrity protection, reliable time, and retention rules.
An incident flow should cover detection, blocking new calls, revoking credentials or freezing tasks, checking in-flight and completed actions, preserving necessary evidence, notification and repair, regression, and controlled recovery. Stopping the chat model does not stop a running database query; cancellation must be confirmed at the executor.
Evidence required before release
At minimum, test:
- discovery, query, cache, and export isolation across identities;
- invalidation of caches, sessions, and long-running tasks after revocation;
- indirect injection through user text, documents, OCR, database content, and tool output;
- unregistered tools, parameter expansion, and approval bypass;
- credential leakage into prompts, errors, logs, or artifacts;
- parameter-level approval, idempotency, and read-back for high-impact actions;
- recipient-aware download and sharing authorization;
- circuit breaking, revocation, and incident drills that stop actual execution.
Unauthorized allow rate is a separate release blocker. Measure false denial and approval burden as well, but do not improve usability by weakening the security gate.
The NIST AI Risk Management Framework and its Generative AI Profile can help organize ownership, risk, measurement, and response. They do not automatically establish legal compliance or replace technical controls.
Governance is mature when every read and action can answer: on whose behalf, for what purpose, under which policy, what actually occurred, who received the result, and how the organization can contain and investigate failure.