What Is AI Agent Data Access and How Much Enterprise Data Can an Agent Actually Reach?

AI agent data access is everything an agent can read through each path it has: connectors, the screens it operates, the permissions of the person it works for, and whatever has already entered its context. For most agents that is the user's whole entitlement, not the task's needs, and sizing it per application rather than per task understates it badly. The agent products shipping in 2026 are built to reach: one connects to more than 4,000 applications through plugins, others read every pixel of the open tab, and all work inside a session a person was entitled to open. The paths compound. The discipline that answers the question is Least Exposure: for each piece of work, the AI receives exactly the data the task requires and nothing more, enforced before any model reads the screen. The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.

Key findings

• OpenAI's dots connect to more than 4,000 applications through plugins (The Next Web, 2026); the model sees the page in full (OpenAI, 2026).
• Claude in Chrome takes screenshots of the active tab, and all visible information, including personal data, becomes part of the model's context (Anthropic, 2026).
• In Copilot Studio computer use, access control only prevents the model from taking actions on sites outside the allow list; it does not stop the model from opening them (Microsoft, 2026).
• Accenture reports that 38 percent of executives expect agents to access data from across the organization within three years, and 29 percent expect agents to access functions in third-party systems in that window (Accenture, 2025).
• Once data is in a model's context, tracking where it flows is an open research problem; Siddiqui and colleagues propose labels that follow only the inputs that influenced an output (Siddiqui et al., 2025).
• An agent's reach becomes an attacker's reach when hidden instructions in content it reads redirect it, the risk OWASP lists first (Greshake et al., 2023; OWASP, 2025).

What does data access mean for an AI agent?

For a human user, data access is one question: which records can this person open? Identity systems answer it with roles and entitlements. For an agent the question splits into four, because an agent reaches data through four paths, each granted by a different mechanism and counted by a different team.

The first path is the connector. An agent product ships with plugins, integrations or Model Context Protocol servers, and each exposes the operations and data scopes its author chose, which is how Anthropic describes MCP: an open standard for connecting AI applications to tools and data through servers a vendor or developer builds (Anthropic, 2024). The second path is the screen. A computer-using agent reads whatever the application renders, and the application was designed to render everything a human on that screen might want. The third path is inherited permission. Almost every enterprise agent works inside a signed-in session, so it reaches what the person who signed in could reach, across every application that session touches. The fourth path is context: once a value has been read, it stays in the model's working memory for the rest of the run, where it can be repeated or carried into a later action.

The paths are additive. An agent with three connectors, a browser and an employee's credentials reaches the union of what the connectors expose, what the screens render and what the employee may open, plus whatever earlier steps left in context. That sum is the agent's data access, and it is rarely written down. The sibling page on data reach covers how to map it; the sections below cover why it is as large as it is and what bounds it.

How much data can an agent reach through connectors and plugins?

Connectors are the path vendors advertise, so the counts are public. OpenAI's dots, launched September 29, 2026, connect to more than 4,000 applications through plugins (The Next Web, 2026). Meta's Muse for Small Business, announced the same day, connects to Shopify, Stripe, Intuit QuickBooks, Slack, Asana, Notion, Dropbox, Box and more, with custom connectors on top (TechCrunch, 2026). Gemini Enterprise includes connectors to enterprise and third-party data under Google Cloud IAM (Google Cloud, 2026). Amazon Bedrock AgentCore's Gateway turns existing APIs and services into MCP-compatible tools (AWS, 2026).

The number that matters is not 4,000. It is the scope of each connector. A connector to an accounting system is written once, by someone who does not know which task the agent will run next, so it exposes what a reasonable set of tasks might need: list invoices, read vendor, read payment details. The agent that needs one invoice total receives the whole answer, and the model reads all of it. A companion page asks whether API connectors give an agent more data than the task needs. Connector scope is set per integration at build time. Task scope is set at run time. Nothing in the connector model closes the gap, and research on tool boundaries shows where it sits: Bhagwatkar and colleagues find that a Minimizer stripping data not needed for a tool call, placed at the agent-tool boundary, is one of two controls that bring indirect injection success near zero (Bhagwatkar et al., 2026).

How much does an agent reach through the screen?

The screen path is larger than the connector path and less often counted, because it appears in no integration inventory. The vendors say what it means. Claude in Chrome takes screenshots of the active tab, and all visible information, including personal data, becomes part of the context; Anthropic's guidance is to avoid opening the extension while viewing sensitive information or documents (Anthropic, 2026). Amazon Bedrock AgentCore Browser perceives pages through screenshots and the DOM (AWS, 2026). Copilot Studio computer use combines vision with reasoning to interact with graphical user interfaces and shares screenshots of the machine's activity in the chat (Microsoft, 2026).

A screenshot carries the whole screen, and enterprise screens are dense. A claims summary shows the claimant's name, date of birth, address and bank details beside the one field the task needs. An EHR encounter screen shows the full problem list beside the single order being placed. The page on what an agent sees when it takes a screenshot counts this per screen; for sizing access, multiply by every screen the agent opens, and a cross-application workflow opens dozens.

The screen path also resists the controls built for the connector path. Microsoft's documentation states that access control only prevents the model from taking actions on websites or applications not in the allow list; it does not stop the model from opening them (Microsoft, 2026). Opening is reading. A Microsoft moderator answering a Purview question wrote that the documentation does not explicitly describe enforcement that detects or blocks the agent's automated browser session actions, nor DLP enforcement against the data-movement step inside that session (Microsoft Q&A, 2026). An allow list bounds where the agent may act. It does not bound what the agent may read, and reading is where data access is spent.

Why do inherited permissions make the number larger than anyone planned?

The third path turns a product question into an organizational one. An agent working in an employee's session holds that employee's entitlements, and enterprise entitlements are wide. They were granted for a person who does many tasks over many years, reviewed quarterly at best, and shaped by the convenience of granting a role rather than a field. Least privilege trims the role to the job; it does not trim the job to the task, and the page on whether least privilege covers what an AI agent sees sets out why those are different questions. The agent inherits the job.

Vendors are candid about this. Copilot Studio's documentation warns that if an agent built with maker-provided credentials is shared, other users can act with the author's access on the machine (Microsoft, 2026). Dots are assigned work through Slack and Teams and connected to the user's apps (The Next Web, 2026), so the dot's reach is the user's reach across those apps. The agent's access is not a new grant a review board can inspect. It is an existing grant, exercised at machine speed by a reader that skips nothing.

The timeline makes the problem compounding rather than static. Accenture's Technology Vision 2025 reports that 38 percent of executives expect agents to access data from across the organization within three years, 29 percent expect agents to access functions in third-party systems in that window, and 32 percent expect cross-organization workflow automation (Accenture, 2025). Those are plans to widen access, on a schedule. Gartner's May 2026 warning that uniform governance across AI agents leads to enterprise agent failure points the same way: agents differ in what they reach, so one policy sized for the average agent starves the narrow ones or over-grants the wide ones (Gartner, 2026). An organization that cannot state what one agent reaches today will not manage it after three years of planned expansion.

What happens to data once it is inside the agent's context?

The fourth path is the one security teams count least, because it is not a grant at all. It is the residue of the other three: every value a connector returned and every screen the agent read stays in the model's context for the rest of the run. OWASP's Sensitive Information Disclosure entry describes the failure that follows: a model reveals, or is given access to, data it should not have, and repeats or transforms it in output (OWASP, 2025). A value read on screen four to complete a lookup is available to the model on screen nineteen when it drafts a message.

Tracking that residue is a research problem, not a configuration setting. Siddiqui and colleagues treat the model as a component in a larger system and show that poisoned data retrieved from one component can coerce it into spreading confidential data to untrusted components; their proposal attaches integrity and confidentiality labels to each input and propagates only the labels of inputs that influenced the output, because labeling every output with the most restrictive label of everything in context blocks nearly all useful work (Siddiqui et al., 2025). Once data is in context, deciding where it may flow requires machinery production agents do not yet have.

The residue is also what an attacker collects. Greshake and colleagues demonstrated indirect prompt injection in 2023: instructions embedded in a web page, email or document the agent reads redirect it to act for the attacker, including by exfiltrating what the agent already holds (Greshake et al., 2023). OWASP ranks the pattern first among LLM risks (OWASP, 2025), which is why the data an agent can reach is also the data a successful injection can reach. Every vendor above documents an injection defense, and every one operates on the model or the action, after the data is in context. The exposure that results is the subject of the companion page on AI agent data exposure. The finding here is narrower: context is a path, filled by the other three, and it does not empty until the run ends.

How should an organization size and bound agent data access?

Sizing starts by refusing the per-application answer, which lists the systems the agent is connected to. The honest answer multiplies four factors: the scopes of every connector, the content of every screen the agent may open, the entitlements of every session it works in, and the context those three leave behind. For an agent working a finance queue through an employee's session with a browser and two connectors, that is the employee's entire reach across the finance system, the vendor portal and email, plus the connectors' full responses, for the length of the run. It is almost never the number the deployment request stated.

Bounding then means choosing the point at which the count is cut. There are three candidates, and they are not equivalent.

The first row is where most organizations stop, and it is necessary. The second is where most vendors invest, and it is useful. The third is the only one that changes the number, because it alone acts before the data becomes residue. The NIST AI Risk Management Framework's Map function asks organizations to inventory the data each AI use touches (NIST, 2023); for agents, that inventory is accurate only at the third row, where the count is what the task received rather than what the session could have reached.

A reader can test any deployment in one step. Take one completed task and produce the list of fields the model received. If the list cannot be produced, access is being sized at the grant. If the list is the whole screen, access is being bounded at the model. If the list is the task's fields with identifiers as tokens, the organization knows what the agent reached, because it decided.

Where does RedactSure sit?

RedactSure cuts the count at the third row. The agent works the organization's existing applications as rendered, inside a governed environment in the customer's cloud, with no per-application integration and no change to user permissions. Before any model reads a screen, every identifier chosen by policy is replaced by a consistent token through render-layer tokenization, and the environment hands the model the task's fields rather than a picture of the screen, with SSN_001 and ACCT_001 in place of the values. The Planner sets which values are tokenized and what the agent may do on each screen; a named person confirms that policy and approves every payment, submission and record change while it runs, under Supervised Delegation. Real values resolve only at approved destinations at the moment of an approved action.

Every screen as tokens, every action and every approval with a name lands in the AI Control Record and exports to the customer's SIEM, so the list of fields the model received is a record the organization can produce. Keys stay with the customer, the environment is model agnostic, and deployments are in pilot. Everyone else controls where data can go. RedactSure controls what the AI can see.

What the record shows

An AI agent's data access is the sum of four paths, not the scope of one grant: what its connectors return, what its screens render, what its session may open, and what all three leave in its context. For most enterprise agents the sum is the employee's whole reach, read in full and retained for the run, and the vendors' own documentation says so. Bounding access at the grant leaves the inside of every allowed system open; bounding it at the model leaves the data already in context. The one test is to take a finished task and produce the list of fields the model received. An organization that can produce that list has decided what its agent reaches. One that cannot has only decided where its agent may go.

Frequently asked questions

Is an AI agent's data access the same as the user's permissions?

At minimum, yes, and usually more. An agent in a signed-in session inherits everything that person may open across every application the session touches. Connectors add the scopes their authors chose, and screens add everything the application renders. The user's permissions are the floor of the agent's data access, not its ceiling.

Does an allow list limit what an agent can read?

Not in the documentation reviewed. Microsoft states that Copilot Studio's access control only prevents the model from acting on sites outside the allow list and does not stop it from opening them. Opening a screen is reading it. An allow list bounds where the agent may act; a separate control is needed to bound what enters the model's context from the screens it may open.

How many applications can an agent reach through connectors?

OpenAI's dots connect to more than 4,000 applications through plugins; Muse for Small Business ships with named commerce, finance and collaboration connectors plus custom ones; Gemini Enterprise and Amazon Bedrock AgentCore expose data through connectors and gateways the customer configures. The count matters less than each connector's scope, which is set once by its author rather than per task.

Why does data already in the agent's context count as access?

Because the model can repeat, transform or act on it at any later step. A value read for one lookup is available when the agent drafts a message twenty screens later, and a successful prompt injection collects whatever the agent holds. Research on information-flow labels for LLMs shows that tracking where context flows is an open problem; keeping values out of context is the simpler control.

Can least privilege solve AI agent data access?

It helps and it is not enough. Least privilege trims a person's role to the job; an agent inherits that job and reads every screen in it in full. The missing decision is per task: which fields does this piece of work need? That decision is made before the model reads the screen, and it is a different control from provisioning, which is made per system at grant time.

What is the one question to ask a vendor about data access?

For one completed task, show the list of fields the model received. A vendor that cannot produce it is sizing access at the grant. One whose list is the whole screen is relying on the model to behave. One whose list is the task's fields with identifiers as tokens has a control that acts before the data enters context, and a record of what was reached.

Related reading

What Is AI Agent Data Reach and How Do You Map Everything an Agent Can Access? · What Is AI Agent Tool Access and How Should Companies Control Which Systems an Agent Can Use? · What Is an Overprivileged AI Agent and Why Can Legitimate Permissions Still Be Dangerous? · What Is AI Agent Data Exposure? · Do API Connectors Give an AI Agent More Data Than the Task Needs? · How to Map All the Data an AI Agent Can Reach · On the RedactSure blog: The Two Gaps AI Agents Opened in Your Security Stack

Sources

Peer-reviewed research and preprints

1. Siddiqui, Shoaib Ahmed, et al., "Permissive Information-Flow Analysis for Large Language Models," Transactions on Machine Learning Research, 2025 (peer-reviewed). https://openreview.net/forum?id=ufYRO8y3mr
2. Greshake, Kai, et al., "Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection," arXiv:2302.12173, 2023 (preprint; also AISec 2023). https://arxiv.org/abs/2302.12173
3. Bhagwatkar, Kasa, et al., "Indirect Prompt Injections: Are Firewalls All You Need, or Stronger Benchmarks?" arXiv:2510.05244, 2026 (preprint). https://arxiv.org/abs/2510.05244

Vendor documentation

4. OpenAI, "How we build safety, security and privacy into dots" (September 29, 2026; vendor documentation). https://openai.com/index/how-we-build-safety-security-and-privacy-into-dots/
5. Anthropic, "Use Claude in Chrome safely," Claude Help Center (2026; vendor documentation). https://support.claude.com/en/articles/12902428-use-claude-in-chrome-safely
6. Anthropic, "Introducing the Model Context Protocol" (2024; vendor documentation). https://www.anthropic.com/news/model-context-protocol
7. Microsoft Learn, "Automate web and desktop apps with computer use," Copilot Studio (2026; vendor documentation). https://learn.microsoft.com/en-us/microsoft-copilot-studio/computer-use
8. Microsoft Q&A, "Clarification on Purview DLP Coverage for Copilot 'Computer Use' Data Exfiltration Scenario" (2026; vendor forum, moderator answer). https://learn.microsoft.com/en-gb/answers/questions/5915515/clarification-on-purview-dlp-coverage-for-copilot
9. AWS, "What is Amazon Bedrock AgentCore?" (2026; vendor documentation). https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/what-is-bedrock-agentcore.html
10. AWS, "Interact with web applications using Amazon Bedrock AgentCore Browser" (2026; vendor documentation). https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/browser-tool.html
11. Google Cloud Blog, "The new Gemini Enterprise: one platform for agent development" (April 22, 2026; vendor documentation). https://cloud.google.com/blog/products/ai-machine-learning/the-new-gemini-enterprise-one-platform-for-agent-development

Regulation, standards and official guidance

12. OWASP, "LLM01:2025 Prompt Injection," Top 10 for LLM Applications 2025 (industry standard). https://genai.owasp.org/llmrisk/llm01-prompt-injection/
13. OWASP, "LLM02:2025 Sensitive Information Disclosure," Top 10 for LLM Applications 2025 (industry standard). https://genai.owasp.org/llmrisk/llm022025-sensitive-information-disclosure/
14. NIST, "AI Risk Management Framework 1.0," NIST AI 100-1, 2023 (official guidance). https://www.nist.gov/itl/ai-risk-management-framework

Industry analysis and press

15. Accenture, "Technology Vision 2025: AI: A Declaration of Autonomy" (January 2025; industry analysis). https://www.accenture.com/us-en/insights/technology/technology-trends-2025
16. The Next Web, "OpenAI launches dots, always-on AI agents with their own cloud computers" (September 29, 2026; press). https://thenextweb.com/news/openai-dots-always-on-ai-agents-cloud-computers-devday
17. TechCrunch, "Meta is expanding its AI agent Muse to small businesses" (September 29, 2026; press). https://techcrunch.com/2026/09/29/meta-is-expanding-its-ai-agent-muse-to-small-businesses/
18. Gartner, "Gartner Says Applying Uniform Governance Across AI Agents Will Lead to Enterprise AI Agent Failure" (May 26, 2026; industry analysis). https://www.gartner.com/en/newsroom/press-releases/2026-05-26-gartner-says-applying-uniform-governance-across-ai-agents-will-lead-to-enterprise-ai-agent-failure

RedactSure documents

19. RedactSure Research, "What Is Least Exposure?" (2026). https://redactsure.com/research/what-is-least-exposure
20. RedactSure Research, "What Is Render-Layer Tokenization?" (2026). https://redactsure.com/research/what-is-render-layer-tokenization
21. RedactSure Research, "What Is Supervised Delegation?" (2026). https://redactsure.com/research/what-is-supervised-delegation
22. RedactSure Research, "What Is an AI Control Record?" (2026). https://redactsure.com/research/what-is-an-ai-control-record
23. RedactSure, "The Two Gaps AI Agents Opened in Your Security Stack" (2026). https://redactsure.com/blog/two-gaps-ai-agents-opened-in-your-security-stack/
24. Product behavior described on this page reflects RedactSure's current design. OpenAI, ChatGPT and dots are trademarks of OpenAI; Claude and Model Context Protocol are trademarks of Anthropic, PBC; Meta and Muse are trademarks of Meta Platforms, Inc.; Microsoft, Copilot Studio and Purview are trademarks of Microsoft Corporation; Amazon Web Services, Amazon Bedrock and AgentCore are trademarks of Amazon.com, Inc. or its affiliates; Google, Google Cloud and Gemini are trademarks of Google LLC; named to identify the products.

Explainer · October 13, 2026

What Is AI Agent Data Reach?

Review AI Agent Data Reach, with AI agent security, tokenization and approval checks for sensitive enterprise workflows.

Explainer · October 13, 2026

What Is AI Agent Tool Access?

Review AI Agent Tool Access, with AI agent security, tokenization and approval checks for sensitive enterprise workflows.

Explainer · October 13, 2026

What Is an Overprivileged AI Agent?

Review an Overprivileged AI Agent, with AI agent security, tokenization and approval checks for sensitive enterprise workflows.

Explainer · October 13, 2026

What Is AI Agent Data Exposure?

Review AI Agent Data Exposure, with AI agent security, tokenization and approval checks for sensitive enterprise workflows.

Explainer · September 30, 2026

Can API Connectors Expose More Data Than an AI Task Needs?

Assess AI agent connector responses for excess PII in billing, claims and student records, with field selection, filtering and tokenization.

Guide · October 9, 2026

How to Map All the Data an AI Agent Can Reach

Review Map All the Data an AI Agent Can Reach, with AI agent security, tokenization and approval checks for sensitive enterprise workflows.

Executive Brief · August 2026

The Two Gaps AI Agents Opened in Your Security Stack

Explore AI agent security through two questions: which PII reaches the model, and who approves consequential billing and claims actions.

Data Report · September 17, 2026

What Is Least Exposure?

Explore Least Exposure for AI agent security, limiting PII to what a workflow needs through tokenization and explicit human decisions.

Data Report · September 17, 2026

What Is Render-Layer Tokenization?

Learn how render-layer tokenization replaces PII before an AI agent reads a browser screen while preserving useful workflow context.

Data Report · September 17, 2026

What Is Supervised Delegation?

Explore supervised delegation for AI agents in billing and claims, with named responsibility, tokenization policies and human approvals.

Explainer · September 21, 2026

What Is an AI Control Record?

Explore an AI agent control record for billing and claims, linking permissions, tokenization decisions, approvals and audit evidence.

Book an AI Agent Security Review →

About the author

Chris SowaCo-Founder, President and Chief Commercial Officer, RedactSure

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.