The organizations RSA works with—banks, government agencies, defense, critical infrastructure—are moving slowly on AI agents. That caution gets read as resistance to change. It isn’t. It’s judgment. In these sectors, failure isn’t friction. Failure is a stalled payment, a delayed treatment, a dead grid.
For roughly 70% of high-security sectors, security and privacy are the top barriers to agentic adoption. That isn’t fear of the new. It’s an accurate read of the stakes.
Historically, the software that banks, government, and all enterprises run on shared a simple assumption: the solutions largely do what you tell them to do, and nothing more. Next week at the AI Conference in San Francisco, I’ll explain how agents break that assumption.
Agents can do what you tell them to do. But they can also do a great deal more. That introduces new risks that most high-security industries aren’t prepared for.
One of the myths that stalls nearly every early agent program is that data residency equals sovereignty. Residency answers one question—where does data sit at rest? Keep it in the right region, in the right cloud, under the right contract, and you’ve satisfied residency.
Agents don’t respect that boundary, because agents don’t work with data at rest. They pick it up, reason over it, and act on it—independently and dynamically. A model hosted in one jurisdiction reasons over customer data from another. Sensitive fields land in prompts, memory, logs, and embeddings that live outside your system of record. The data moved, and residency never had anything to say about that motion. That motion is where sovereignty actually breaks.
We adopt agents for their autonomy. They act without waiting to be told, and that is genuinely valuable—in fact it’s the whole point.
But autonomy is inseparable from authority. An agent that can act on your behalf can move money, grant access, change a record, or invoke another system. The capability you bought is now the exposure that you carry.
That’s one of the reasons why highly regulated industries are right to be cautious about implementing agentic services. Because when they do, they’re not deploying a tool. They’re delegating authority. And most organizations haven’t scoped what they’ve handed over.
In the session I break the problem into four control points. They go beyond the usual data-and-infrastructure lens, because an agent touches more than data:
Decision: who controls the outcome, right now?
An agent with standing, broad credentials can authorize a high-consequence action with no human in the loop. Delegation chains break down, and you can’t prove an action traces back to an accountable human. Review that exists on paper but times out under latency pressure fails open instead of failing safe.
Data: what can the agent know, touch, and carry?
Beyond residency, this is lineage: can you answer what the agent saw and used to reach a decision after the fact? Prompt injection can turn a poisoned document into an exfiltration instruction. Without classification and minimization at the point of action, sensitive data flows ungoverned.
Infrastructure: where does it run, and under whose control?
A shared, multi-tenant environment offers no guarantee of jurisdictional or physical isolation. Cloud-hosted inference can quietly reintroduce the exact exposure an organization thought it solved with on-premises storage. Classified environments can’t call hosted model APIs at all—which is how shadow workarounds get born.
Ecosystem: what else can the agent influence, or act through?
Agents chain into third-party tools and servers no one vetted or registered. One compromised downstream tool can act through your agent’s already-granted privilege. Partner and vendor agents inherit access transitively, and a supply chain of agents-calling-agents has no single place to enforce or audit policy.
Deploy an agent and you’re operating across all four at once, whether or not you’ve scoped them.
Prompt- and model-level guardrails are probabilistic. They lower the likelihood of a bad outcome; they don’t provide assurance. Regulated industries can’t audit “probably didn’t.” A guardrail can catch a known bad pattern, but it can’t attest to who an agent is, where it’s running, and what it’s authorized to do for a novel action.
High assurance means grounding every action in identity. An agent needs a verifiable identity and scoped, provable authority, so every action ties back to a known actor, a known authorization, and an auditable chain. Identity is the anchor the other three control points hang from—control the decision, govern the data, verify the infrastructure, and constrain the ecosystem, all against an actor you can actually name. Get identity wrong and the other three are guesswork.
Before you let an agent act, you should be able to answer the following: Who authorized this? Where did it run? What data can it reach Can you prove it?
If those answers are clean, continuous, and auditable, you can move fast on AI and still pass the audit. If they aren’t, you’re not governing agents—you’re hoping. Sovereignty is a posture, not a certificate. It’s continuous and auditable, because agents act continuously, and a control you can’t prove on demand isn’t a control.
Agentic sovereignty is the ability to retain provable control over what an autonomous AI agent decides, touches, runs on, and acts through—continuously and in a way that will satisfy audits. Unlike data sovereignty, which concerns where data resides, agentic sovereignty concerns authority in motion: every decision an agent makes and every action it takes on your behalf.
No. Data residency governs where data sits at rest. AI agents work with data in motion—they pick it up, reason over it, and act on it dynamically, often across jurisdictions and outside the system of record. Residency has nothing to say about that motion, which is precisely where sovereignty breaks down.
Because the cost of failure is severe—a stalled payment, a delayed treatment, a disrupted grid—not mere inconvenience. Security and privacy are the number one named barrier to adoption for roughly 70% of high-security organizations. The caution reflects an accurate read of the stakes, not resistance to change.
Decision (who controls the outcome and whether a human is accountable), Data (what the agent can know, carry, and whether its lineage is traceable), Infrastructure (where it runs and under whose control), and Ecosystem (what other tools and agents it can influence or act through). Every agent deployment operates across all four simultaneously.
Prompt- and model-level guardrails are probabilistic. They reduce the likelihood of a bad outcome but don’t provide assurance, and regulated industries can’t audit “probably didn’t.” A guardrail can flag a known bad pattern but can’t attest to an agent’s identity, environment, and authority for a novel action.
High assurance means every agent action is grounded in a verifiable identity and scoped, provable authority, so it ties back to a known actor, a known authorization, and an auditable chain. Identity is the anchor; controlling decision, data, infrastructure, and ecosystem all depend on being able to name the actor behind an action.
Three: Who authorized this? Where did it run? Can you prove it? If you can answer all three continuously and on demand, you can move quickly and still pass the audit. If you can’t, you aren’t governing the agent—you’re trusting it.
