AI agents are pushing access controls and testing into the data layer

Snowflake’s message to enterprise data teams this week was blunt: the access controls built for a “dashboard era” won’t govern AI agents. Once an agent can move between data, tools and actions, permissions that were good enough for a human analyst inside a BI interface stop being a reliable boundary, according to TechTarget’s Computer Weekly.

That warning is arriving as security teams are also rethinking how they test AI agents before and after deployment. In a separate report, TechTarget said experts are pushing comprehensive testing practices designed to prevent agents from pursuing goals beyond prescribed instructions, and to keep validation going after go-live, not only in the lab.

Put together with the CISO perspective on “AI orphans” and identity sprawl, the operational takeaway is that agent rollouts are turning governance into an engineering problem again. The organizations that can instrument identity, data access and agent behavior like any other production system will move faster with less drama.

Governance is shifting from dashboards to the data layer

Computer Weekly reported Snowflake’s view that governance can’t be “baked into” model weights and that traditional access controls tied to dashboards are mismatched to how agents work. Agents don’t just read a chart. They assemble context, query multiple sources and can be wired to take actions in downstream systems, which changes the threat model and the control points.

For operators, this reframes where to spend time. The hard work moves into the data platform and its policy layer: fine-grained entitlements, data classifications, row and column-level security, and the logging that lets a governance team answer the uncomfortable question after an incident: what did the agent touch, and why was it allowed?

Testing AI agents looks more like production engineering than model evaluation

In TechTarget’s reporting on AI-agent security testing, experts described testing as a full lifecycle discipline. The goal is not only to measure whether an agent completes tasks, but whether it stays within the boundaries defined by policy, tool permissions and the organization’s intent as the environment changes.

That “environment changes” clause is the operational trap. In enterprises, the toolchain around an agent is rarely static: connectors change, APIs evolve, permissions drift, and teams add new actions because they want the agent to do more. The testing regime has to catch those shifts, which implies post-deploy monitoring, regression tests tied to workflow changes, and clear rollback paths when an agent’s behavior becomes unpredictable.

The resilience angle: inventory, ownership and “AI orphans”

InformationWeek’s reporting on CISOs at Intuit, Smartsheet and ETS framed the near-term risk as unmanaged proliferation. As agent counts grow across departments, identity management becomes more complex and creates higher security risk, and “AI orphans” emerge when no team can confidently say who owns a given agent, what secrets it holds, or what it is allowed to access.

This is where governance turns into a systems-of-record problem. If agents are being created inside multiple platforms, from data tools to productivity suites, the enterprise needs an inventory with owners, environments, last-change dates and access scopes. Without that, access reviews and secrets rotation become aspirational.

Agent governance work that belongs in 2026 roadmaps

The new messaging from Snowflake and the CISO community suggests a pragmatic sequencing for enterprises that want agents without widening their risk surface. Start with the control points that scale: identity, data-layer policy enforcement, and continuous testing that follows the agent into production.

Questions to take into the next platform and IAM review

• Where is the enforcement point for an agent’s access: BI/dashboard permissions, the data platform policy layer, or the tool it is acting through? Document the chain, then decide where “deny” must live.
• What is the minimum inventory record for every agent: owner, business purpose, allowed data domains, connected tools, and secrets location? Tie it to an access review cadence.
• What post-deployment tests run when a connector, permission set, prompt template, or downstream API changes? If nothing triggers, the organization is relying on luck.
• How will logs be joined across identity, data access and agent actions to support audit and debugging? If the answer is “three dashboards,” the organization is still in the dashboard era.