Governance and regulation. What the rules actually require of agent access.
Three frameworks keep coming up in agent reviews. These pages take the narrow part of each one that touches what an agent can reach, and leave the rest to your counsel.
Questions, answered.
The basics, in two answers.
Which rules apply to AI agents?
It depends on the use and the sector rather than on the technology. The EU AI Act classifies AI systems by what they are used for, NIS2 covers risk management and incident reporting for entities in its annexes, and the OWASP agentic list is not a regulation at all but a risk checklist. None of them names agent permissions directly, and all three end up there.
Is this legal advice?
No. These pages describe how the requirements land on access control, which is the part a security team acts on. Scope, applicability and liability are questions for your own legal counsel.
Other Academy categories.
The same picture from a different starting point.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.