Summary
- Traditional access controls may not prevent sensitive information from being disclosed through AI-generated responses when retrieval permissions differ from underlying record restrictions.
- Inference pipelines and agentic AI introduce additional security risks involving prompt injection, tool permissions, and unsupervised model activity.
- Effective AI governance requires technical safeguards within the inference infrastructure, alongside traceable activity, input sanitisation, and enforceable access controls.
Access has become the primary focus of AI governance. Businesses are interested in who’s using what, and with which data. Questions are asked around vendor procurement, and security is front and centre. And that’s as it should be. But with AI use becoming more prevalent, this level of scrutiny is no longer enough. Risk has stopped being a matter only of access; it’s now firmly rooted in the inference pipeline. That sequence of steps where a trained machine-learning model takes a new input and produces a prediction or output is almost entirely unsupervised in the majority of businesses. And it’s exposing them to a range of consequences.
The issues of access control reliance
The reason access controls have been the governance priority in AI is that they’re familiar. Security teams are already using access controls throughout every business, both physical and digital. People understand their value, whether for identity management, permissioning, or data loss prevention. So, adding them into AI governance feels like an obvious and natural next step. Unfortunately, it’s not always as useful as it seems, because AI systems are an entirely different beast.
The problem is, large language models don’t really retrieve records. They piece together answers from whatever context they’re given. And that can mean that users who would otherwise lack the credentials to access a sensitive record directly might still be able to see its content through an AI-generated summary if the permissions of the retrieval layer are different. So, while the record is restricted, the information isn’t. And that’s where the inference pipeline comes in.
It’s in the inference layer that context retrieval, prompt assembly, model execution, and response validation are at play. And each step is open to attack. All the more so, because very few businesses currently treat it as needing any form of boundary control. And when you add in agentic AI, the problem only gets worse.
How agentic AI complicates the matter
When you bring in agentic models that move beyond answering questions and start taking actions, vulnerability spreads into the orchestration layer too. Prompt injection becomes an operational risk because a malicious input can influence how the model interprets instructions, uses tools, or decides what to do next. It could even lead to the system working around its own safeguards, without you ever realising that something is wrong.
Security isn’t the only problem
If you operate in a regulated industry, then compliance is always a consideration. And that’s where auditability becomes a priority, because you have to be able to show not only what data was used and where, but how those decisions were made, and whether the controls you have in place were consistently applied. This isn’t something that most businesses can do where AI is deployed. When something goes wrong, there’s rarely a reliable audit trail to investigate it, because inference calls aren’t really traceable and little context is available. Outputs aren’t often stored, and when they are, it’s rarely with related metadata. And that brings major compliance headaches.
Policies are no longer enough
The real challenge is that we still tend to treat governance as a policy problem. In traditional systems, you could define the rules at the boundary and trust the system to behave consistently inside them. AI is different. What a system does can change depending on how the data, model, and orchestration layer interact. So, governance needs to be built into the infrastructure to manage that, not just written down in a perfectly formed policy document. Access controls need to follow data into context retrieval and output filtering. And sensitive information needs to be dealt with before it ever reaches the model. That means checking and sanitising inputs as a matter of course. And ensuring tool access is limited by clear, explicit rules. Perhaps most importantly, every inference should also leave behind an audit trail that lets you see what happened and why.
AI governance is no longer merely a security issue. It’s now about engineering – and arguably always should have been. In building controls into the inference layer, businesses can finally achieve genuine defensibility within their AI systems. From a compliance perspective as well as a security one.
