Recent Axios reporting and an essay by Microsoft CEO Satya Nadella highlight a growing concern: AI agents are advancing faster than the controls designed to contain them. To be useful, agents need access to tools, networks, and data, but that same access can enable unintended actions, even without a sandbox escape.
At Virtru, we believe this challenge demands a simple principle: data must be both protected and productive. Locking information away defeats the purpose of deploying agents. Giving agents unrestricted access creates unacceptable exposure. The goal should be to make the right data available under the right controls.
As we outlined in our previous blog, The Modern AI Security Triad, agentic security requires three complementary layers: agent identity to govern who is acting, AI gateways to govern the flow of information, and cryptographically bound data policies to govern access to the data itself. Identity and gateways remain essential, but they do not replace object-level protection. That third layer helps keep data both protected and productive, or available to authorized agents only.
Containment asks, “How do we keep this agent inside its boundaries?” Data-centric security adds another question: “What information should this agent be permitted to consume?”
The Trusted Data Format (TDF), the open standard powering Virtru’s platform, makes the third layer possible by binding access policies directly to individual data objects. With encryption applied to the object itself, protection travels with the information rather than depending solely on the repository, application, or network holding it.
In a TDF-enabled workflow, an agent’s request for protected data is evaluated against the object’s policy and the requesting identity’s entitlements before decryption is authorized. Access is enforced, not merely suggested in a prompt. Agents can consume the protected objects you permit them to access, while other objects remain encrypted.
Consider a procurement agent: it could be authorized to analyze supplier proposals without receiving access to unrelated employee records. That is the balance we should aim for. Useful access without blanket exposure.
Object-level protection complements agent containment, identity controls, and monitoring; it does not replace them. Nor should access control be mistaken for a guarantee about how an agent behaves after receiving plaintext.
It does provide an essential enforcement point: owners can adjust policies and restrict or revoke future access to protected objects as needs change.
With agent capabilities advancing rapidly, we should stop treating protection and productivity as opposing goals. The answer is not simply to build a better cage around the agent. It is to put enforceable boundaries around the data, and let agents work within them.