BigID and Varonis, two of the larger companies in data security, have both shipped products in the last couple of months aimed at the same problem: AI agents getting to company data.
BigID launched AgentIQ on September 21. It lets customers run their data security and compliance work from a prompt or an AI agent, either inside BigID or from assistants like Claude, Copilot, GPT, and Gemini. According to BigID, agents working through AgentIQ inherit the permissions of the person who asked, and every action they take is logged.
Varonis announced Agent Intent-Based Access Control in August as part of its Atlas platform. It compares what an agent was told to do with what the agent actually does: the tools it calls, the data it opens, and its reasoning along the way. If the agent drifts from its instructions, Atlas can alert on it, block the action, or quarantine the identity behind it.
I think both are well engineered, and both companies are responding to a real problem. Agents now open files, call tools, and pass work to other agents, and most of the access controls companies have in place today were designed for people.
Both products control the agent
Based on what each company has published, the two products take the same basic approach. They limit what an agent is allowed to do, record what it does, and step in when it does something it wasn’t asked to do.
| Dimension | BigID AgentIQ | Varonis Atlas Agent IBAC |
|---|---|---|
| What it covers | Agents doing data security and compliance work through BigID | Agents connected to enterprise data |
| How it limits an agent | The agent inherits the requesting person’s permissions | The agent’s actions are checked against the instruction it was given |
| What it records | Every action, tied back to a person | Every action and its intent, across the whole session |
| What happens when something’s wrong | Access stays limited to what the person could do | Alert, block, or quarantine the identity |
Two kinds of agents
Most of the agents people use today work on someone’s behalf. Copilot is one example, and so is an agent working through AgentIQ. They run with the permissions of the person using them, so if that person can open a file, the agent can open it too.
Other agents run under their own identity. A company sets them up with a service account or another machine identity and gives them their own access, separate from any one person. They often run without anyone watching in real time, and some are started by other agents.
The difference matters because the risks aren’t the same. An agent working for a person can surface anything that person has access to, including files they forgot they could open. An agent with its own identity can reach whatever it was granted, and that access is easy to set too broadly and hard to keep track of.
What controls on the agent leave open
Controls on the agent decide what an agent is allowed to do, and they make those decisions before or during the request. They don’t change what the data looks like once an agent is allowed to open it, or once one gets to a file through access that was set too broadly.
For an agent working on someone’s behalf, what matters is how much that person can reach in the first place. For an agent with its own identity, what matters is whether the files it reaches can be read at all.
I’m not saying agent governance is wasted effort. Knowing which agents exist and what they’re doing is useful, and it isn’t something PKWARE does. But it works on the agent, and neither of those problems gets solved without also working on the data.
What’s in the rest of this series
Part 2 looks at what protecting the data does for each kind of agent, and where it stops. Part 3 turns that into five questions to ask a data loss prevention (DLP) or data security posture management (DSPM) vendor before you buy.
Sources
BigID Launches AgentIQ, BigID press release, September 21, 2026.
Varonis Introduces Agent Intent-Based Access Control, Varonis press release, August 3, 2026.