What Anthropic’s Zero Trust for AI Agents Means for the Data Layer
Agentic security requires a layered approach. The data layer is the highest leverage control point for security and governance teams.
Enterprises are deploying autonomous AI agents into production faster than they can secure them, and the best practices for securing this complex new landscape are still being established. Anthropic’s Zero Trust for AI Agents is one of the strongest contributions so far: a clear, practical map for hardening an agent against a threat landscape that shifts week to week. It is worth reading closely.
The framework’s focus is on the agent itself. The data layer beneath it deserves the same attention, and there is a strong case for addressing it early. Securing any agent starts with knowing what it can reach, and the controls at every other layer, identity, runtime isolation, monitoring, and response; all assume you already know what data the agent can touch. Data security and governance are what makes that assumption true. It is also a high leverage point of control, because every agent draws on the same underlying data, so governing that data once carries the effect to every agent above it.
And it is the one layer where control can be made deterministic. Anthropic’s framework asks any control whether it makes an attack impossible or merely tedious and warns that friction alone fails against an AI-powered attacker with unlimited patience. Data controls answer that test well. Agent behavior is probabilistic by nature; data controls are not. Data that has been minimized is not there to leak, and access that has been revoked cannot be reached, no matter how an agent is prompted or manipulated. As regulators impose concrete penalties and grow less willing to accept probabilistic assurances, that certainty is a foundation worth building on.
You cannot govern a foundation you cannot see
Every control in this framework assumes you already know the answer to the foundational question. How many AI models, Copilots, and Agents are already touching your data.
For most enterprises, the honest answer is no. Models come pre-enabled inside SaaS apps arrive switched on inside SaaS products. Teams spin up copilots and pilots without informing security. Agents get connected into databases, file shares, and APIs faster than anyone tracks. This is shadow AI, and it is the rule rather than the exception.
A living inventory of every model, agent, and AI service, and what data each one can reach, is the front door to everything else. Every control in the framework assumes you can see what you are securing. Discovery is what makes that assumption true. You cannot enforce least privilege on agents you do not know exist or protect data you’ve never mapped.
One agent is a control problem. A fleet is an architecture problem.
Anthropic’s framework concentrates its controls at the level of the individual agent across identity, permissions, memory, and tools. It does address multiple agents, but mainly as a question of trust between them, how one agent delegates to or inherits from another, with fixes still applied to one agent at a time. That is exactly the right altitude for hardening agents, and the guidance there is solid.
However, production never runs one agent. It runs a fleet. A customer-service assistant, a finance copilot, a research agent, an internal knowledge agent, plus a dozen unapproved pilots, all reaching into the same underlying systems. The AI layer is not one service. There are many, and it will continue to grow.
What ties these agents together is the data layer underneath it. One agent reaching over-permissioned data is a risk that is contained. A hundred agents drawing on the same over-permissioned, poorly classified data is a single shared exposure that scales with every agent added. No amount of per-agent hardening closes a weakness that lives in the layer beneath all of them, because each new agent simply inherits the same weak foundation.
This is why the data layer has a major leverage. Govern the shared foundation once, and every agent you deploy on top of it inherits that posture, rather than resolving data governance for every new agent.
Zero trust for AI agent fleet is a data problem
Read through a data lens, the three Zero Trust principles all point to the same foundation.
Assume breach becomes a question of blast radius. If you accept that one of your agents will eventually be manipulated or simply reason its way somewhere you did not intend, then the goal is to make sure the data it can reach when that happens is as small as possible. You shrink the blast radius before the breach happens, not after.
Least privilege becomes the least agency applied to data. Anthropic makes a useful distinction between least privilege, what an entity can access, and least agency, what it is allowed to do. On the data layer, that means an agent should be able to reach only the specific data its task requires, at the sensitivity level its task requires, and nothing more.
Never trust, always verify becomes a matter of knowing what every identity can reach. Not just human users, but the service accounts, the agents, and the non-human identities that increasingly outnumber people in any modern environment. Verification you cannot tie back to data access is verification of the wrong thing.
Where Securiti AI operationalizes the data layer security
Operationalizing those Zero Trust principles at the data layer is what Securiti AI does, and it starts with discovery: a continuous inventory of the AI models and agents in your environment and the data it touches, shadow AI included.
From there, the center of gravity is access. Most tools on the market are good at showing you the blast radius. They will tell you that an agent can reach millions of sensitive records. But knowing is not the same as fixing, and the job is to shrink that radius, which is an active discipline rather than a dashboard. Securiti AI gives you visibility into who and what can access sensitive data, surfaces the over-privileged and dormant access and the toxic combinations that create real risk, right-sizes those entitlements toward least privilege, and applies dynamic masking so an identity sees only what it is entitled to see. And the data that does not need to exist is the safest kind: minimizing redundant, obsolete and trivial (ROT) data shrinks what any agent can reach before a single permission is evaluated. Those are containment levers, applied to the shared foundation, before an agent ever calls on it.
Around that core sits the rest of the data layer. Lineage, agent activity, and full data-and-AI context give you the forensic trail and the explainability that both incident response and regulators demand: who touched what data, why, and on whose authority, from source through to output. On detection and response, we are deliberately not trying to be your SIEM, your SOAR, or your SOC. Instead, we feed those systems the data context they have always lacked, so the alerts your team already investigates carry the sensitivity, access, and lineage that turn a generic anomaly into an actual risk decision.
The framework’s input and output controls land here too, but as a question of data integrity. An agent’s output is only ever as trustworthy as the data feeding it. If the source data is poisoned, stale, or over-exposed, the agent will still reason over it and act with confidence. Discovering, classifying, and sanitizing that data at the source is how you earn the right to trust the agent. And because so much of this is ultimately about regulations and compliance, governance runs through all of it. Securiti AI operationalizes privacy and AI compliance, mapping your AI systems to GDPR, the EU AI Act, and the NIST AI RMF with evidence drawn from live data rather than static questionnaires, automating the work through purpose-built agents, and keeping shadow AI in view as part of the same motion.
Data layer and Agent layer in a Zero Trust framework
Zero trust for agents runs across more than one layer, and the layers do different jobs. The agent layer governs the agent itself: its identity and authentication, its credentials and tokens, its runtime isolation, and the automated response that contains it when something goes wrong. Much of that lives in the agent platform and runtime, where Anthropic’s framework and its own tooling do a great deal of the work, alongside the identity and security operations stack you already run.
The data layer governs what every one of those agents reaches. What data that identity can touch, and whether that access is right-sized, masked, or revoked, is the data layer’s job, and that is where Securiti AI works. The two reinforce each other. Strong agent identity means little if the data beneath it is over-exposed, and a well-governed data layer means little if anyone can impersonate the agent that reaches it. Securiti AI sits alongside the framework and your existing stack as a complement, not a competitor to either. Govern the data layer well, and every agent above it inherits a stronger foundation.
Why securing the data layer matters now
Agents are arriving in the enterprise faster than the governance around them. A single agent on over-permissioned data is a contained risk. A fleet of them on fragmented, ungoverned data is something else: it takes scattered, long-tolerated data governance gaps and turns them into a systemic security problem, because the same weak data sits beneath every agent at once.
That is also where some of the fastest wins are. Reducing sensitive-data exposure and over-permissioned access before agents are wired in is one of the quickest ways to shrink an agent’s blast radius, and it pays off across every agent that touches that data rather than one at a time. Discovery, classification, ROT minimization and access intelligence do not replace the identity, isolation, monitoring, and response controls in Anthropic’s framework, or the SIEM and SOAR your team already runs. They give those controls the data context to act well.
And for the moments when something does get through, recovery is the last line. Being able to restore your data, and the context your agents depend on, to a known-clean state is what separates a contained incident from a crisis. It is where Securiti and Veeam come together, and it is the part of the assume-breach promise that much of the market still skips.
The agent layer and the data layer advance together. As the Agentic fleet grows, the data beneath it is the foundation that must hold.
Read about how Veeams supports Anthropic’s framework
Request a demo to see what your agents can actually reach. Securiti AI DSPM maps the sensitive data, access, and exposure across your environment, so you can shrink the blast radius before you scale a single agent on top of it.
