A procurement lead asks an AI agent to summarize renewal terms for a software vendor. The agent pulls from a contract repository, a legal team’s chat thread, and a spreadsheet of negotiated discounts. A second agent turns the summary into a briefing and posts it to a shared workspace. No person reviews either handoff. Three weeks later, the vendor quotes an internal walk-away price that was never meant to leave the company. Security can inspect the repository, the chat tool, and the workspace, and each one looks normal.
What nobody can reconstruct is the path the data took between them.
What Is Agentic Workflow Security?
Agentic workflow security is the practice of tracing and controlling how data moves through workflows where AI agents retrieve, transform, and hand off information. This form of data security takes the workflow as the unit of protection, spanning applications, files, endpoints, and agents, and it covers human-to-human, human-to-AI, and fully agentic work.
The discipline is vital for enterprises now because generative and agentic AI usage has multiplied the number of hands, human and machine, that touch a single piece of data at any given time. Protecting each destination in isolation leaves the connections between them unwatched, multiplying risk.
Why Do File-Centric and App-Centric Controls Miss Agent Activity?
Enterprise security has historically started at systems of record, such as SaaS applications, data warehouses, and document repositories. Content inspection scans files at rest and attachments in transit. Access policies decide who can open which repository. Those controls were built for data that stays in a recognizable container.
Where systems of delivery change the picture
Agentic AI adds systems of delivery, which assemble information on the fly from many sources to serve a customer, an employee, or a business process. The output depends on a chain of source systems, permissions, prompts, transformations, and results rather than one database or application.
Prompts, summaries, snippets, tickets, and generated content form an ever-growing pool of derivative data, and those fragments move independently of their source. A sentence lifted from a contract into a summary, then into a second agent’s draft, reads as new content with no visible parent. A single data point can spawn hundreds or thousands of such derivatives.
Why visibility erodes with every handoff
“As soon as replication and fragmentation happen, you start losing visibility,” says Nishant Doshi, CEO of Cyberhaven, in the MIT Technology Review executive briefing on securing the agentic enterprise with data lineage. Visibility into how an output was produced often disappears once a task finishes. Teams that once managed a handful of daily interactions with sensitive data now face AI systems that can generate thousands of decisions and exchanges in the same period.
The result is an audit trail that ends where the agent’s task ends.
What Does It Mean to Make the Workflow the Unit of AI Security?
Doshi describes the new unit of AI security as the workflow itself. Organizations now operate in three workflow modes, and real work crosses all of them.
- Human-to-human: Colleagues share and edit information directly.
- Human-to-AI: A person prompts a generative AI tool or delegates a task to an agent.
- Fully agentic: Agents pass information to other agents with no person in the loop.
Consider one piece of customer data. An analyst prompts an agent, the agent writes a summary into a shared document, and a colleague pastes that summary into an email to a partner. The data crossed all three modes in an afternoon. A control scoped to one mode sees a third of the story, and the handoffs between modes, where fragments are most likely to slip loose, fall in nobody’s view.
Security teams therefore need one record of the workflow rather than three partial ones. Visibility has to span human actions, agent actions, data access, transformations, and downstream delivery. It also has to reach shadow AI, which includes personal accounts, unofficial connectors, plugins, skills, and workflows that employees adopt to work faster.
How Does Data Lineage Replace Blanket Blocking With Risk-Based Control?
Data lineage supplies two facets a workflow-level view needs. Provenance shows where data originated. Movement shows how it spread and transformed afterward. Together they provide context, and context is what separates routine activity from risky activity.
“What data lineage adds to the equation is context,” Doshi says. With context, security teams can calibrate controls to data sensitivity, user identity and permissions, workflow purpose, transformations involved, and likely downstream consequences.
- Allow low-risk activity to proceed without friction.
- Coach on medium-risk activity with guidance, just-in-time prompts, or an approval step.
- Redirect high-risk workflows to sanctioned environments with suitable guardrails.
Context also resolves the hardest cases, the legitimate exceptions. A blanket rule may say annual recurring revenue figures never leave the company, yet a finance lead has a valid reason to share them with a lender. Lineage plus normal workflow patterns lets security approve that exception without defaulting to broad restriction or broad exposure.
The same context helps teams detect inappropriate sharing and spot sensitive information being used in unsanctioned ways. It extends the traditional file-centric model, which focuses on documents in storage and attachments in transit, down to the smaller units of data moving through agentic workflows.
Cyberhaven CISO Aman Sirohi sums up the goal: “Good security removes the friction from innovation.”
Hear Sirohi’s take on how agentic security can fuel innovation in this webinar with MIT Technical Review.
What Are the Five Steps to a Data Lineage-Based Roadmap for Agentic AI Security?
The MIT Technology Review Insights report, produced in partnership with Cyberhaven, outlines five areas for a lineage-first strategy.
- Inventory AI usage: Track sanctioned and shadow AI, including personal accounts, connectors, skills, and unsanctioned workflow components. According to IBM research cited in the report, 63% of breached organizations lacked AI governance policies, and 20% experienced breaches linked to shadow AI.
- Establish end-to-end lineage: Extend visibility across endpoints, SaaS platforms, on-premises systems, prompts, outputs, agents, and downstream data flows.
- Define ownership and accountability: Classify and authorize data use. AI operators manage execution and transformation, while business owners stay accountable for decisions based on outputs.
- Apply least-privilege access controls: Treat agent access as an identity and access management priority, granting each agent only the permissions its role requires.
- Implement continuous monitoring and response: Identify risky data movement, assess exceptions, simulate outcomes, and refine policies using observed workflow data.
Sequence matters. Steps one and two create the evidence that steps three through five depend on. A team that assigns ownership before it can see the workflows is assigning accountability for activity it cannot yet observe.
How Cyberhaven Data Lineage Secures Agentic Workflows
Cyberhaven is Data Security for the Agentic Enterprise. Cyberhaven traces the full lifecycle of your data, adapting protection to changing context. That lifecycle record is Data Lineage, which captures where data originated, how it moved and changed, and who or what touched it across endpoints, SaaS applications, and AI tools, both generative and agentic.
Lineage gives security teams an inventory of AI usage, a traceable path for each fragment of data, and the evidence that ownership and least-privilege decisions need. Agentic Data Security applies that context to the AI tools and agents employees use, so teams can protect workflows, not just data.
Because protection adapts to context, teams can take action when and where it matters. Low-risk work proceeds, medium-risk work gets coaching, and high-risk work moves to a sanctioned path.
Agents will keep assembling information from more sources and passing it along faster than any manual review can follow. The teams that scale AI safely will be the ones that can trace each fragment from origin to destination, and respond based on context instead of guesswork.
Explore this topic further with the MIT Technology Review Executive Briefing, “Securing the Agentic Enterprise with Data Lineage.”
See Agentic Data Security in action by requesting a demo.
Frequently Asked Questions
What is the difference between a system of record and a system of delivery?
A system of record, such as a SaaS application, data warehouse, or document repository, stores information. A system of delivery dynamically assembles information from multiple sources to serve a customer, employee, or business process. Agentic AI creates systems of delivery, and securing them requires tracing the assembly process, not only the sources.
Why can’t legacy DLP secure AI agent workflows on its own?
Legacy DLP inspects content in files at rest or attachments in transit. Agent workflows produce prompts, summaries, and snippets that move independently of their source documents. Content inspection alone can miss a fragment whose origin and path are unknown. Data lineage adds the missing context about where the fragment came from and where it went.
What is data lineage in AI security?
Data lineage is the ability to trace data and its fragments across human and machine workflows throughout their lifecycle. It rests on two things, provenance, or the point of origin, and movement, or how data spreads across workflows. In AI security, lineage lets teams explain how an output was produced.
What is shadow AI and why does it complicate governance?
Shadow AI is the use of unsanctioned AI tools, including personal accounts, unofficial connectors, plugins, skills, and workflows. Most of it is well-intentioned, as employees adopt tools to work more effectively. It complicates governance because security teams cannot assess risk in workflows they cannot see.
How should security teams apply least privilege to AI agents?
Treat agent access as a core identity and access management priority. Grant each agent only the permissions its specific role requires, and review those permissions as the workflow changes. Pairing least privilege with lineage shows which agents touched which data, which makes over-permissioned agents easier to find.
Can security teams allow agent activity without reviewing every action?
Yes. As decisions become more autonomous, organizations rely more on exception-based intervention than on manual review of every action. Lineage-based context lets teams allow low-risk activity, coach on medium-risk activity, and redirect high-risk workflows, so human oversight concentrates where it matters.
.avif)
.avif)
Insights for the agentic enterprise
New guides, reports, and insights on data security, sent as they publish.