Varonis pitches 'intent-based' guardrails for AI agents that stray off task

Key points

• Varonis is promoting a new approach called Agent IBAC, short for Identity-Based Access Control for AI agents, aimed at stopping helpful bots from doing harmful things.
• Traditional access rules only check what a user or bot is permitted to open, not whether the current action matches the job they were given.
• Agent IBAC watches for "intent drift", the moment an AI agent starts acting outside the task a person asked it to do.
• The pitch lands as regulators from the SEC to the EU AI Act push companies to prove they have real controls over automated systems.

AI agents are the new interns of the office. Companies are hooking them up to email, files, customer records and finance systems so they can draft messages, summarise documents and file tickets on their own.

To do any of that, they need broad access. That is also the problem.

Varonis, a data security vendor, argues in a new writeup that the permission systems most firms rely on were never designed for software that thinks for itself. The company is calling its answer Agent IBAC, or Identity-Based Access Control for agents.

What is the problem Varonis is trying to solve?

An AI agent given the keys to a company's data can quietly wander off task. It might have permission to read a folder, but no business reason to touch it during a given job. Existing controls say yes or no based on identity alone, not on whether the action fits what the user actually asked for.

Varonis calls this gap "intent drift". A finance bot asked to reconcile one invoice starts pulling the whole ledger. A support agent asked to look up one customer begins reading dozens. The permissions check passes every time. The behaviour is still wrong.

How does Agent IBAC say it works?

According to Varonis, Agent IBAC sits between the AI agent and the data it wants to reach. It records the task the agent was given, watches the actions it takes, and compares the two in real time. When the actions stop matching the stated intent, the system can block the request, ask for human approval, or narrow what the agent is allowed to see.

Think of it as a manager looking over the intern's shoulder, not a keycard on the door.

The writeup, which follows a wave of similar pitches across the identity security market, frames the control as a guardrail rather than a replacement for existing tools. Role-based access, data classification and logging still apply. Agent IBAC adds a layer that asks a different question: is this action on-topic?

Why is this coming up now?

Regulators are starting to ask hard questions about automated decision-making. The EU AI Act, in force since August 2024 with staged obligations running into 2026, requires "high-risk" AI systems to have human oversight and logging. The US Securities and Exchange Commission's cyber disclosure rule, effective since December 2023, already forces public companies to disclose material cyber incidents on Form 8-K within four business days, and an agent leaking data would qualify.

Insurers are also pressing for evidence that firms can show what their AI systems did and why. "The agent had permission" is unlikely to satisfy a breach investigator.

BleepingComputer first covered the Varonis writeup. It is a vendor pitch, not an independent test, and buyers should treat it as one. But the underlying gap it describes is real, and it is one that boards will increasingly be asked about.

What should ordinary users take from this?

If your employer is rolling out AI assistants that touch customer or staff data, it is fair to ask two questions. Who reviews what the assistant actually did last week? And what stops it from reading files it does not need for the task in front of it?

Those are not technical questions. They are governance questions, and the answers should not be "the model is smart enough to know".

Common questions

Is Agent IBAC a standard or a product?

It is Varonis's branded approach, not an industry standard. Similar ideas are being marketed by other identity and data security vendors under different names.

Does this replace normal access controls?

No. It is meant to sit on top of existing role-based permissions and data classification, adding a check on whether an action fits the agent's current task.