What is agent reach?
Agent data reach is the set of sensitive data an AI agent can eventually access through the identities, credentials and permissions available to it.
- Agent reach, also called agent data reach, is the set of sensitive data an agent can eventually get to through its credentials, not only what its own permissions allow.
- It is the union of four layers: direct permissions, assumable roles, readable secrets and inherited grants. Most reviews cover the first one.
- Two agents with identical permissions can have completely different reach, which is why a permission review alone does not rank risk.
- The output is a set of paths ending at a sensitive store, not a score. That is what makes it actionable: you close a path by changing one step.
Published Last reviewed
In practice
Agent data reach is not the same as the permissions granted to the agent. It includes everything reachable through further steps: a role it can assume, a token it can read from a file, an OAuth grant held by the account it runs as. Two agents with identical direct permissions can have very different reach.
Measuring reach answers the practical question behind most agent risk reviews: if this agent were misused, what could someone get to? The term is unrelated to the open source tool named Agent Reach, which gives agents internet access.
Agent data reach is the set of sensitive data an AI agent can eventually access through the identities, credentials and permissions available to it.
Four layers, and only one of them gets reviewed.
Reach is the union of these four. A review that covers the first layer and stops there will call Agent B below low risk.
What the agent’s own identity is allowed to do. This is the only layer most reviews look at, and on its own it almost never explains an incident.
Roles the identity can switch into. One assumable role can add more reach than every direct permission combined, and it does not appear in a list of the agent’s own grants.
Keys and tokens the agent can read from files, environment variables or a vault it has access to. A credential the agent can read is a credential the agent has.
OAuth grants and live sessions held by the account the agent runs as. The employee approved them for themselves, and the agent running under that account gets them too.
Same permissions, different reach.
Both agents would pass a permission review identically. Only one of them can read production data today.
| Two agents, same permissions | Agent A | Agent B |
|---|---|---|
| Direct permissions | repo:read on 3 repositories | repo:read on 3 repositories |
| Assumable roles | None | ci-deployer, which can read the production database |
| Readable secrets | None in its environment | A .env file with a database URL |
| Inherited grants | None | A drive grant from the account it runs as |
| Reach | Three repositories | Three repositories, production data and a shared drive |
How to measure it. Four steps.
The result is a set of paths with a sensitive store at the end, not a single score.
What the agent’s own identity is allowed to do.
Roles the identity can switch into, and what those roles allow.
Keys and tokens the agent can read from files, variables or vaults.
OAuth grants and sessions held by the account the agent runs as.
What it looks like in Elmoz
A real path shape, drawn the way the Elmoz security graph shows it.
Questions, answered.
Short answers on agent reach, also called agent data reach.
How is data reach different from permissions?
Permissions describe what one identity is allowed to do directly. Data reach adds everything reachable through further steps, such as roles it can assume and credentials it can read. Two agents with the same permissions can have very different reach.
How do you measure agent data reach?
Start from the agent’s identity, follow every credential and role it can use, and record which sensitive data stores sit at the end. The result is a set of paths, not a single score.
Is agent data reach related to the Agent Reach tool?
No. Agent Reach is an open source project that gives agents internet access. Agent data reach is a security measure of what data an agent could get to.
Keep reading.
The pages that belong to the same picture.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.