Varonis Agent IBAC is a runtime security control that monitors AI agents' behavior by comparing their actions against the original instructions they received. It detects intent drift—when an agent's actions diverge from the user's request—and applies real-time guardrails such as blocking, alerting, or quarantining the agent's identity. The system evaluates the full session context, including prompts, responses, and tool calls, to catch subtle or cumulative deviations, including multi-turn jailbreak attempts. Sensitivity settings allow tuning from lenient to strict enforcement, suitable for different data sensitivity levels. Agent IBAC maintains a complete audit trail for compliance and investigation. It operates inline between the AI agent and the underlying model, enabling immediate intervention before actions execute. This capability addresses the limitations of traditional access controls that cannot assess intent or context in AI-driven workflows.

Agent IBAC mitigates risks associated with AI agents performing unauthorized or unintended actions that could expose or misuse sensitive enterprise data. By detecting and stopping intent drift in real time, it reduces the likelihood of data breaches, accidental data exposure, or destructive actions such as unauthorized data migration or deletion. The quarantine feature further limits repeated or escalated misuse by blocking the agent identity for a configurable period. This enhances enterprise confidence in deploying AI agents with broad data access while maintaining security and compliance.

Agent IBAC is available now as part of Varonis Atlas and provides real-time enforcement of AI agent behavior policies. Enterprises using Varonis Atlas should enable and configure Agent IBAC according to their risk tolerance and data sensitivity. The system's tunable sensitivity and customizable guardrails allow balancing security and productivity. No additional patching is required beyond deploying or updating Varonis Atlas with Agent IBAC. Organizations should review audit trails and adjust policies as needed to optimize detection and response. Since this is a new security capability rather than a vulnerability, no traditional patch or fix is applicable.