In short
An AI agent that supports the legal team queries the drive, contract management and email. Among the documents it can reach are contracts under a confidentiality clause, open only to the lawyers on each case. If the agent answers anyone in the department with everything it can read, the clause loses its effect. Access control is the set of rules that defines who can see or change each piece of data. With agents, it has to follow every query, and it is one of the functions of the Company Brain, the layer that knows the company: what data exists, where it lives, how it relates and who can see what.
Every enterprise system answers three questions before displaying a record: who is asking, what that identity can do and on which records. Authentication settles the first. Access control settles the other two, with rules for reading, changing and deleting. Three models are the most widely used:
Access control in an HRIS usually combines all three. The manager role unlocks the performance module, the business unit attribute restricts it to the branch and the row-level rule shows only direct reports.
In traditional systems, the person opens the screen and the system applies the rule. With an agent, an intermediary appears that receives the question, queries several systems and assembles a single answer. It acts on someone's behalf, and every system it queries needs to know on whose behalf.
The answer also mixes sources with different rules. A question about an employee may bring together the HRIS, payroll and internal tickets. If one source releases more than it should, the excess goes into the answer along with everything else.
The language model does not enforce permissions on its own. An instruction in the prompt to leave out restricted data depends on the most likely continuation and can be circumvented by a well-phrased question. Access control has to happen earlier, when the sources are queried.
The 2025 edition of the OWASP list for LLM applications covers several of these risks under excessive agency and recommends executing actions taken on a user's behalf in that user's context, with the minimum privilege necessary.
The Company Brain connects ERP, HRIS, contract management and documents once and organises that data in a knowledge graph. Permissions come along with it. Each query carries the identity of whoever asked, and each source returns the slice that person already sees in the system itself.
There is no parallel control to maintain. In an M&A deal, the confidential project's documents are restricted to the project group in the repository. The FP&A agent receives only what the analyst who asked can already open, and when someone leaves the group, the change at the source applies to every agent.
The context is served to the model over MCP, already filtered, and every answer cites the source system and record. Security can reconstruct who asked, which sources were read and with which permission.
The LGPD limits processing to the minimum the purpose requires and demands measures against unauthorised access. An agent that reads medical records from the whole base to answer about one patient goes against both principles. Record-level access control, applied before the model, and a log of every query are the evidence of how the company handles this data.
Inheritance is only as good as the source permission. Legacy systems with coarse profiles, where the whole finance team sees everything, need an additional rule, defined with the area that owns the data.
Inheriting also means inheriting mistakes. Periodic access reviews are still necessary and carry more weight, because the agent makes any access easier to exercise.
A good starting point is a case where access is already well defined at the source, such as confidential contracts in legal. Before connecting the agent, it is worth mapping which systems it queries, with which credentials and whether the identity of the person asking reaches each source. With that map, the first agent's access control rests on inherited permissions, and the following cases reuse the same connections and rules.
