AI Agents Can Act on Your Data: Why Protecting Proprietary Information Is Now a Board-Level Decision

Why Now

Artificial intelligence is moving beyond analysis and content generation into systems that can take actions. The National Institute of Standards and Technology (NIST) defines artificial intelligence agents as systems capable of planning and taking autonomous actions that affect real-world systems or environments. In May 2026, NIST reported that respondents to its inquiry on artificial intelligence agent security broadly agreed that agents present novel security threats and that established cybersecurity practices must be adapted to address them.^[1][2]

For executives, the issue is not theoretical. When an artificial intelligence agent is connected to enterprise applications, it can potentially retrieve documents, invoke tools, generate external communications, alter records or support operational decisions. If proprietary information, customer data, source code, financial records or strategic plans are within reach, weak governance can become a direct business exposure.

IBM's 2025 Cost of a Data Breach Report provides measurable evidence. In the United States, the average cost of a data breach reached $10.22 million. Organizations with high levels of shadow artificial intelligence observed average breach costs $670,000 higher than organizations with little or no shadow artificial intelligence. Security incidents involving shadow artificial intelligence compromised intellectual property in 40% of cases studied, compared with 33% across breaches globally.^[3]

Executive Summary

Artificial intelligence governance is now an enterprise-value control. Boards and executive teams should require clear answers to five questions:

1. Which artificial intelligence systems and agents are operating in the organization?
2. What proprietary or regulated data can each system access?
3. What actions can each agent take without human approval?
4. How are unsafe access, leakage or misuse detected and contained?
5. What evidence demonstrates both business value and effective control?

The objective is not to prevent responsible artificial intelligence adoption. It is to ensure that autonomy is earned through controlled access, bounded authority, testing, monitoring and executive accountability.

Verified Evidence for Decision-Makers

Cisco's findings are based on a survey of more than 5,200 information technology, technology and security professionals with data-privacy responsibilities across 12 markets. IBM's findings are based on organizations that experienced data breaches. These datasets should be interpreted separately, not combined into a single benchmark.^[3][4]

The Executive Risk: Proprietary Information Moving Without Sufficient Control

Artificial intelligence agents become materially different from stand-alone analytical tools when they are connected to enterprise data and operational systems. An agent that can retrieve confidential files, invoke external tools or initiate actions may create a faster path for disclosure or misuse if access is poorly governed.

The assets at risk extend beyond personal information. They may include:

• Product designs, research data and source code.
• Pricing strategies, forecasts and acquisition materials.
• Customer analytics, underwriting models and internal decision logic.
• Contracts, regulatory documents and confidential communications.

A policy instructing employees not to paste confidential information into artificial intelligence tools is insufficient where agents can retrieve or transmit information through integrated systems. Protection must be enforced through architecture, permissions and monitoring.

Six Actions Executives Should Require Now

1. Establish One Authoritative Artificial Intelligence Inventory

Record approved and discovered artificial intelligence systems, agents, models, vendors, business owners, connected tools, accessible data and risk classifications. Unknown systems cannot be governed effectively.

2. Define and Enforce Proprietary-Data Boundaries

Classify sensitive information and establish rules determining which artificial intelligence workflows may access, process or transmit it. Apply access controls, data-loss prevention, redaction or tokenization where appropriate.

3. Treat Agents as Privileged Non-Human Identities

Each production agent should have an accountable owner, scoped credentials, limited permissions and an approved set of tools. Agents should not inherit broad employee access or rely on uncontrolled shared accounts.

4. Require Authorization for Consequential Actions

Payments, external disclosure of confidential material, production-code changes, customer-record modifications and other irreversible activities should be subject to policy controls and, where warranted, human approval.

5. Test and Monitor Agent Behavior

NIST identifies indirect prompt injection, data poisoning and harmful agent actions as relevant risks. Organizations should test agents before deployment and monitor their data access, tool use, denied requests, escalations and anomalous behavior during operation.^[1]

6. Report Value and Risk Together

Artificial intelligence dashboards should show realized business benefits alongside sensitive-data access, blocked events, testing results, incidents and remediation status. Scale should follow demonstrated value and demonstrated control.

The Control Architecture

A defensible operating model places governance above deployment and controls around every material agent workflow:

This approach is consistent with NIST's Artificial Intelligence Risk Management Framework, which is designed to incorporate trustworthiness considerations into the design, development, use and evaluation of artificial intelligence systems.^[5]

The Leadership Decision

Artificial intelligence agents can create value only when executives can trust the data they access and the actions they take. The board-level standard should be clear: no agent should reach proprietary information or execute material actions unless its authority is bounded, its behavior is monitored and its business value is measurable.

Organizations that govern autonomy well will be positioned to scale artificial intelligence with confidence. Those that do not may discover that their most powerful new capability has become an uncontrolled channel to their most valuable information.

Sources

1. National Institute of Standards and Technology, CAISI Issues Request for Information About Securing AI Agent Systems, January 12, 2026.
2. National Institute of Standards and Technology, Summary Analysis of Responses to the Request for Information Regarding Security Considerations for AI Agents, May 18, 2026.
3. IBM, Cost of a Data Breach Report 2025, official report and release, July 30, 2025.
4. Cisco, 2026 Data and Privacy Benchmark Study, January 2026.
5. National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, July 26, 2024.

Smart Tech LLC: Governance that enables scale. Controls that protect value. Evidence that supports decisions.