What is agent data reach?
Agent data reach is the set of sensitive data an AI agent can eventually access through the identities, credentials and permissions available to it.
In practice
Agent data reach is not the same as the permissions granted to the agent. It includes everything reachable through further steps: a role it can assume, a token it can read from a file, an OAuth grant held by the account it runs as. Two agents with identical direct permissions can have very different reach.
Measuring reach answers the practical question behind most agent risk reviews: if this agent were misused, what could someone get to? The term is unrelated to the open source tool named Agent Reach, which gives agents internet access.
Agent data reach is the set of sensitive data an AI agent can eventually access through the identities, credentials and permissions available to it.
How it works. Step by step.
The parts that make it up, in an environment with AI agents.
What the agent’s own identity is allowed to do.
Roles the identity can switch into, and what those roles allow.
Keys and tokens the agent can read from files, variables or vaults.
OAuth grants and sessions held by the account the agent runs as.
What it looks like in Elmoz
A real path shape, drawn the way the Elmoz security graph shows it.
Questions, answered.
Short answers about Agent data reach.
How is data reach different from permissions?
Permissions describe what one identity is allowed to do directly. Data reach adds everything reachable through further steps, such as roles it can assume and credentials it can read. Two agents with the same permissions can have very different reach.
How do you measure agent data reach?
Start from the agent’s identity, follow every credential and role it can use, and record which sensitive data stores sit at the end. The result is a set of paths, not a single score.
Is agent data reach related to the Agent Reach tool?
No. Agent Reach is an open source project that gives agents internet access. Agent data reach is a security measure of what data an agent could get to.
Related terms.
Terms that belong to the same picture.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.