AI Agent Security With Policy-Driven Access Control
Red Hat, Tuesday, October 27th, 2026
Red Hat proposes translating governance documents into enforceable data access policies to stop over-permissioned AI agents.
Red Hat argues enterprises are deploying agentic AI faster than they can secure it, and that agents are commonly over-permissioned because fine-grained policies are hard to configure across systems.
The authors propose a translation layer that extracts access rules from governance documents, generates configurations for enforcement points such as vector databases and feature stores, and validates them with automated tests.
They note protocols like MCP control which tools an agent can call but not what data those tools return.
A proof of concept using the open source asago framework showed role-based denial of claims data to an underwriter, and Red Hat is exploring surfacing these controls in OpenShift AI.