BigID defines the missing governance layer for autonomous AI agents. Aug 04, 2026, 15:03 ET Agentic Access Control and Intent-Based Activity Monitoring give security teams a policy layer for agents and a live check on their behavior, matched against intent instead of static permissions LAS VEGAS, Aug. 4, 2026 /PRNewswire/ - BigID, the leader in data security and AI governance, today announced Agentic Access Control and Intent-Based Activity Monitoring. The two capabilities answer the question dominating hallway conversations at Black Hat this year: once an agent has access to your data, what actually stops it from doing something you never approved? Permissions were built for people. Agents don't act like people. Role-based access control assumes a human is behind every request: someone who logs in, clicks around, and occasionally asks for more access. Agents don't work that way. They act at machine speed, chain tasks across systems on their own, and can drift from their original purpose long before anyone notices. That leaves two blind spots most security teams haven't closed: * No policy layer built for agents. Access is still granted the way it's always been granted: broad roles, standing credentials, rarely revisited. * No visibility into what agents actually do. Even with the right access in place, few teams can say with confidence what an agent did with it, or whether those actions matched the task it was given. Govern the access. Then watch the behavior. BigID's new capabilities close both gaps, together. Agentic Access Control is a policy layer purpose-built for AI agents: * Scopes what an agent can touch based on the sensitivity of the data itself, not just a role or a credential * Adjusts access dynamically as an agent's task changes, instead of granting one broad permission set upfront * Runs every authorization decision through BigID's data intelligence, so access always maps to what the data actually is Intent-Based Activity Monitoring watches what happens after access is granted: * Establishes what an agent is supposed to be doing, then checks its actual behavior against that intent, continuously * Flags actions that stray from intent, even when they're technically within permitted access * Traces the full chain of what an agent read, moved, or acted on, tied directly to the sensitivity of the data involved Together, they form what BigID calls an authority layer: one system of record for what an agent is allowed to do, what it says it's trying to do, and what it's actually doing, all grounded in the data. Why security teams need this now Agent adoption has outrun the tooling meant to govern it. Static permissions can't keep pace with agents acting on their own, and activity logs alone can't tell you whether an action was expected or a warning sign. BigID ties both problems back to the one thing that doesn't shift underneath you: the data. Quick answers What is agentic access control? A policy framework that governs what an AI agent can access, based on data sensitivity and task scope, rather than static roles or standing credentials. What is intent-based activity monitoring? A way of checking what an AI agent actually does against what it was authorized and expected to do, flagging deviations even when the action falls within permitted access. How is this different from traditional access control? Traditional access control checks permissions once, at the point of entry. BigID checks continuously, against both data sensitivity and the agent's declared intent, and adjusts as the task evolves. Who needs this? Any organization giving AI agents standing access to sensitive data: customer records, source code, financial systems, regulated data of any kind. What sets BigID apart * Breadth. Coverage spans every AI app, agent, and data environment in the estate, not a narrow slice of sanctioned tools, so nothing operates outside the policy layer by default. * Context. Full inventory of AI apps and their metadata gives visibility into intent before an action happens, not just a record of access after the fact. * Activity monitoring that knows the whole picture. Every action is evaluated against data context, stated intent, and identity together, so a flagged action is never judged on permissions alone. Executive quote "Every agent you deploy inherits a level of trust. The real question is whether you can verify that trust is earned continuously, not just granted once at setup." - Nimrod Vax, Co-Founder & Head of Product, BigID. About BigID BigID is the only AI-native platform built to secure data and govern AI across the enterprise. BigID helps organizations discover, classify, protect, and manage sensitive data at scale, from cloud storage and databases to SaaS applications, code repositories, and AI systems. BigID has been recognized for innovation as a World Economic Forum Technology Pioneer; by Forrester as a Leader in Sensitive Data Discovery and Classification; named to the Forbes Cloud 100; the Inc 5000 for 5 consecutive years; the Deloitte 500 for 5 consecutive years; Market Leader in Data Security Posture Management (DSPM); and an RSA Innovation Sandbox winner. SOURCE BigID

BigID has launched what it calls the AI sovereignty standard for enterprise data governance. The platform enables organisations to govern data and AI systems entirely within their own infrastructure boundaries, whether cloud-based, on-premises, or fully air-gapped. The company's architecture operates without dependency on external model providers. BigID runs with zero outbound connectivity, keeping configuration, findings, and audit logs inside customer environments. Customers can use their own approved language models to power the platform's AI capabilities. The move addresses growing regulatory requirements around data residency and vendor concentration risk. AI sovereignty extends data sovereignty principles to AI models, prompts, and governance systems built on regulated data. BigID supports self-managed, private cloud, and disconnected deployments whilst maintaining consistent discovery, classification, and governance capabilities across all environments. The platform can operate during isolation events without external connectivity.