Why intent is the third leg of AI agent access control, and why least privilege collapses without it.

The last piece in this series (blog 1, blog 2) made a single argument: enterprise data deserves an identity, not just a classification. An identity carries the context that actually determines risk, assembled by stitching together who the data represents, which organization owns it, which regulations govern it, and how it relates to other information. Public, Confidential, and Restricted describe a sensitivity level. An identity describes what the data is.

That argument has a natural next move.

Data does not sit alone. The moment an agent reaches for it, that rich data identity meets the identity of whatever is doing the reaching. And here the industry is already converging. Cyera, a data security platform recently valued at $12 billion, signed a letter of intent to acquire the non-human identity company Oasis Security for roughly a billion dollars, to unite data and identity into a single system governing what every agent is allowed to reach. What the data is and who is touching it are being stitched into one control.

Two Legs of the Stool

Leading analysts read the same convergence as a requirement rather than a trend. To control an AI agent’s data access, security teams have to triangulate three things at once: the human identity behind the request, the agent identity acting on it, and the sensitivity of the data itself. Do that, and access can be granted just in time and rightsized to the moment instead of provisioned broadly and left standing.

The reason all three are mandatory becomes obvious the moment you try to drop one. Rely on the human’s identity alone and the agent inherits that person’s full, broad privileges, far more than any single task requires. Rely on the agent’s identity alone and you open the door to prompt-jacking, where a human steers the agent into something they were never authorized to do. Neither identity suffices alone. You need the human, the agent, and the data in the same decision.

Call these the first two legs of the stool. Identity answers who. Data answers what.

It feels complete. It is not.

Least Privilege Was Always an Equation With a Missing Variable

Everything above is in service of a principle security teams have chased for decades: least privilege, the minimum access an entity needs to perform the function it is meant to perform. Analysts covering agent access control make a point that is easy to skip past and turns out to be the whole game. Least privilege is an equation, and the equation cannot be solved without knowing intent. If you do not know the function an agent is meant to perform, you cannot configure least privilege for it, and you certainly cannot enforce it.

For human users, we approximated intent with static roles and got away with it, because a person supplied the judgment the role definition left out, deciding case by case what they actually should open.

Agents remove that runtime judgment. Handed a role, an agent executes against it at machine speed across dozens of tool calls, never pausing to ask whether a particular reach fits the task. Broad standing permissions plus no runtime judgment is a precise recipe for access sprawl. Intent is the variable that was always missing, and with agents no human is quietly supplying it.

Intent is the third leg.

Not All Intent Is Equal

This is where most conversations about intent go wrong. Intent is not one thing you switch on: three distinct intents are in play, and they are not interchangeable.

The first is the organization’s intent for the agent: what the agent exists to do. This is the strongest and most enforceable form, and it works best when expressed deterministically, through the same business roles a human performing that function would hold. An agent built for IT service management has no business reaching into the HR system or the source code repository. That boundary is not inferred. It is declared, and it holds. Expressing the same intent in natural language is better than nothing, but it requires another layer of AI to translate words into policy, and that translation carries an error rate. Ignoring organizational intent entirely, because it is not sufficient by itself, actively degrades access control and drives up excess-privilege incidents.

The second is the human’s intent at the prompt. In principle, the specific ask in a session could narrow an agent’s access from everything its role permits down to just what the task needs. That is the real meaning of intent engineering. In practice, inferring prompt intent with AI today produces both false denials that block legitimate actions and false approvals that let unauthorized ones through. The analyst assessment here is direct: this is not yet ready to drive runtime access decisions on its own, and is far more useful for improving deterministic policy than for making the call in the moment.

The third is the agent’s own stated intent, the workplan it will happily narrate if asked. It is the easiest of the three to obtain and the most dangerous to trust, because no entity should ever authorize its own access. An agent’s account of what it intends cannot decide whether it is allowed to do it. That is a segregation-of-duties violation wearing a helpful face.

So intent-based access control is not a single lever. Organizational intent sets the outer boundary, deterministically. Prompt intent refines within it. The agent’s own intent is evidence to evaluate against policy, never a substitute for it.

Watching Intent Travel Through the Reasoning Loop

There is one more reason the agent’s stated intent cannot be taken at face value, and it is why cognitive-loop visibility matters. Intent does not stay a single clean sentence. The agent takes one objective and decomposes it into a chain: it reasons, plans, selects a tool, invokes it through MCP, retrieves data, combines it with something else, and acts. Across that chain, the original intent fragments into many sub-actions, and it can drift.

This is why the headline purpose is not enough resolution. Industry analysts are explicit that data risk has to be assessed at each isolated segment of the workflow, not against the stated goal or the final outcome. A single step buried inside a perfectly reasonable objective can touch a sensitive element that, in isolation, creates real exposure.

Visibility into the reasoning and execution loop is what closes that gap. Not so the agent can grant itself access, but so the organization can enforce policy step by step, catch the moment the action chain diverges from the intent that launched it, and feed those observations into access analytics. The agent’s intended actions are a superb detection and enforcement signal. They are simply not an authorization source.

And the answer to a risky segment is rarely a hard block. Blocking an agent outright, the way traditional data loss prevention would, tends to push people toward workarounds less safe than the path you closed. The goal is to rightsize each action to what the task needs, in the moment, not to build a wall the business will route around.

The Third Leg

Identity tells you who is reaching for the data. Data identity tells you what is at stake when they do. Intent is the only one of the three that tells you whether this specific reach, in this specific step, belongs to the task at all.

For thirty years we rightsized access with roles and trusted a human to supply the judgment the roles left out. Agents do not supply it. Intent is how that judgment finally gets encoded into the system itself. Leave it out, and least privilege for agents is not a control. It is a number nobody can compute.

Computing it is the real work, and it means seeing all three intents in one place: integrating with the major agentic platforms to anchor an agent to its purpose and the person behind it, observing the prompts that set each task in motion, and intercepting the tool calls and reasoning steps the agent takes to carry it out. Assembling that combined view is what Bonfy is built to do, so that each data access can be weighed against the intent behind it rather than waved through on a standing permission.