Varonis Ships Access Control That Judges What Agents Do

Varonis released Agent Intent-Based Access Control on August 3, per The Manila Times. For security teams running AI agents, it targets a specific hole. Role-based access control was never built to judge what a non-human identity does with access it already holds, per the report.

The system compares an agent's reasoning, tool calls and data access against its original task, then flags or blocks anything outside that scope. RBAC tells you what an agent can reach. It doesn't watch what the agent does once it's there, and that's the gap Varonis is aiming to close.

The scoring runs across whole sessions instead of single requests, built to catch jailbreaks that build gradually over many turns. Sensitivity is adjustable. When a session crosses the threshold, Varonis can quarantine the agent's identity or route the session to a human for review. The announcement doesn't say how many false positives to expect or who sets the sensitivity threshold on a given deployment.