INSIDER THREAT ADVISORY (iTA) WORKSHOP
Access Without Entitlement: How Shared AI Agents Break Policy Controls
When: Tuesday, September 22 | 1:00 — 2:00 PM PT
Brought to you by:
Overview
This year’s i³ Threat Advisory series has focused on what AI agents do once they’re deployed: how they exfiltrate data, build toolchains, and blur the line between human and machine activity. This advisory examines a more fundamental question: what AI agents allow users to access.
When abused, or simply misconfigured, this class of shared agent can:
- Surface documents to a user who holds no native permission to open them
- Turn a routine agent query into unauthorized data reconnaissance with no file transfer
- Bypass RBAC entirely at the embedding layer, without triggering a single policy violation
- Grant a low-privileged insider the effective reach of the agent’s build-time service account
- Leave almost no forensic trace, because no control was technically broken
Because the user never touches the restricted data directly, and because the agent behaves exactly as designed, the activity looks like normal, sanctioned productivity. It resembles nothing the detection stack is tuned to catch.
What you’ll learn:
- How shared AI agents can expose sensitive data beyond intended permissions
- Findings from a real-world experiment measuring agent-driven access expansion
- Techniques for detecting agent privilege escalation and hidden access paths
- Best practices for reducing AI agent risk through monitoring, governance, and access controls
- How the DTEX Integration Framework closes the gap by bringing IdP group membership and agent resource-access audit together, so the platform can finally see not just what a user did, but what they were entitled to do
RSVP for the workshop
View ITA library
The DTEX i³ Insider Risk Research Hub publishes regular insider threat research and advisories based on real-world investigations to help analysts stay ahead of insider threats as they arise.
Contact I3 team
DTEX i3 provides threat briefings on the latest insider risk research, early behavioral warning signs, and best practices, using data-driven insights from internal experts and partners like MITRE.