Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Does Your Company Give AI Too Much Access to Its Data?
Why AI agents inherit more access than any new employee would get, and how to check
In brief
-
Most AI tools and agents inherit a user's access, so they can read everything that person can see.
-
In one Oracle customer I worked with, an AI tool had been given open access to the ERP to produce insights for the team.
-
Nobody gives a new employee access to everything on day one. An AI deserves the same restraint.
-
Excessive agency and sensitive information disclosure are named risks for AI applications, and least privilege per session is a core zero trust principle.
-
The test for any AI deployment: what does it need to see for this task, and who approves anything consequential?
AI used to look like a prompt box. Someone typed a question, it answered, and a person decided what to do. AI agents work differently. An agent reads the screen, moves between systems and takes actions, and in most deployments it does so with the full access of the person who launched it. The question I now ask every organization I work with is a simple one: does your AI have access to more data than the task needs?
The open door
On a recent webinar about securing the AI stack, I described one company we went into. It is an Oracle customer and is not named here.
“We went into one company and […] they had set it up so that their whole [ERP] environment was pretty much an open door for the AI to gather information, which provided insights to the team. But like I said, you wouldn't give access to everything to a new employee, and doing it with an AI is just as foolish.”
Chris Sowa, speaking on a RedactSure webinar
The team did get useful insights. The question is whether anyone decided that an AI should be able to read every customer, supplier and payment record to produce them, or whether it simply inherited that reach because the connection was easy to make.
Why AI ends up with too much access
The leaders I talk with describe the same mechanism from different seats. The CFO of a large community health system explained what administrative AI tools can see in his organization:
“The AI tools, whether it's Copilot embedded in Microsoft tools or folks using Gemini or other layered agents, they can pretty much read anything once they're launched. They are reading the full dossier.”
CFO, community health system
A former senior executive at two large enterprise software and security companies named the governance problem underneath it:
“AI actually took the action, but it didn't give itself the legitimate authority. Somebody else gave it that authority. […] maybe there were some design criteria where it could actually give itself the authority, or it was just a hidden authority, or you thought that it wouldn't do it.”
Former executive, enterprise software and security companies
Hidden authority is the right name for it. Access controls were designed for people. They answer whether an identity may open an application. They do not answer whether a particular task needs a particular field. When an agent inherits a person's access, it gets every field, every time.
Where the line should be
Organizations already draw this line for people. The CISO of a Fortune 500 industrial company reminded me that, in most companies, personal data is handled by a small group:
“Even in most companies, there are only some employees, like HR, that are even allowed to handle this data.”
CISO, Fortune 500 industrial company
A healthcare services company I have worked with draws a similar line for AI. Its technology leadership keeps AI away from frontline operations staff and uses it with a senior team on defined work:
“We've been focusing it on mostly our senior development team, helping to expand the velocity by which we develop software, and then different solutions that we've developed: medical coding being one, AR collections being another, performing large-scale reporting on complex calculations such as net collections rate.”
Technology executive, healthcare services company
Both are versions of the same principle. NIST's zero trust architecture grants access to individual resources per session, with the least privilege needed for the task (Rose et al., 2020). Applied to AI, the agent should see what the task requires, for as long as the task runs, and no more.
The dangerous combination
A technology executive at a global energy company gave me useful advice on how to explain the risk. Show what happens when a single agent has access to private data, reads untrusted content such as inbound email, and can send information outside the organization. Put those three together and a prompt injection can turn the agent against its owner. OWASP ranks prompt injection first and sensitive information disclosure second among risks to AI applications, and lists excessive agency, meaning too much functionality, permission or autonomy, as its own risk (OWASP, 2025).
Guardrails inside the model help, but they are instructions, and instructions can be overridden. The stronger control is to make sure the agent never holds the sensitive values in the first place.
Questions to ask about your own environment
-
Which AI tools and agents are connected to your ERP, CRM, EHR or finance systems today, and through whose access?
-
For each one, what can it read on the screen, and does the task need all of it?
-
Can any of them read untrusted content and also send data outside the organization?
-
Which actions can they take without a named person approving?
-
Could you show, after the fact, what the AI saw and who approved what it did?
Where RedactSure fits
RedactSure answers the access question at the screen. Permissions stay exactly as they are. What changes is what the AI can see: sensitive values become tokens before the model reads the page, real values resolve only at approved destinations, and a named person approves consequential actions. Everyone else controls where data can go. RedactSure controls what the AI can see.
Frequently asked questions
Why do AI agents get too much access?
Because most agents run with the access of the user who launches them, and user access was designed for people opening applications, not for tasks. The agent inherits every field the person can see, whether or not the task needs it.
Does least privilege cover what an AI can see?
Not by itself. Least privilege usually governs which applications and records an identity can open. An AI that reads the screen sees everything the page shows. Controlling what the AI sees within an authorized screen is a separate control.
What is excessive agency in AI?
OWASP's term for an AI application that has more functionality, permissions or autonomy than its task needs. It is one of the ten top risks in the OWASP Top 10 for LLM Applications.