Here's a question we've been failing to answer for forty years: "Why do you need access to this data?"
Not "do you have the right role" or "did your manager approve." The actual reason. What are you going to do with it?
We never figured this out. Role-based access became permission-based access, which became "just give everyone read access so they stop opening tickets." The fundamental question went unanswered because we couldn't answer it at scale.
Now we can.
The Question We Couldn't Ask
Traditional access control operates in absolutes. You either have access or you don't. The system can't interrogate intent because intent requires understanding context, reasoning about purpose, and making judgment calls.
Humans can do this. It's why data stewards exist. Someone senior enough to ask "wait, why do you need the complete customer database?" and recognize when the answer doesn't smell right.
But humans don't scale. So we built permission systems that granted access based on job function, assuming role was a good proxy for legitimate need. It wasn't, but it was the best we had.
What's Changed
AI systems — particularly large language models — can now infer likely intent from context and usage patterns. They can read a request, consider surrounding information, and ask the obvious follow-up questions.
"I need access to the HR database."
"Which tables specifically? What analysis are you performing? Who will see the results?"
More importantly, they can evaluate whether the stated intent aligns with what's actually requested. If someone says they need employee contact information for a mailing list, but they're querying salary data, that's a mismatch. A human reviewing the request might catch it. An AI watching the actual queries definitely will.
Before going further: when we talk about agentic AI, we mean AI systems that don't just respond to queries but actively pursue goals, make decisions, and take actions on their own initiative. Unlike a simple AI agent that waits for commands, an agentic system can monitor ongoing activity, reason about context, and intervene when it identifies something worth investigating. This distinction matters because purpose-based access requires continuous oversight, not just one-time decisions.
Beyond the Letter to the Spirit
This is where it gets interesting. Access policies are written in the letter of the law. "Employees in the Finance department have read access to financial records." Clean, auditable, legally defensible.
But there's also a spirit. Finance employees have access because they need it for their jobs. The policy assumes they'll use it appropriately: generating reports, reconciling accounts, supporting audits. It doesn't assume they'll download everything and sell it to a competitor.
We've always relied on deterrence and detection for the spirit — legal consequences if caught, monitoring systems that might catch you. But we haven't embedded the spirit into access control itself.
AI can. It can infer whether your usage pattern aligns with typical patterns for legitimate business purposes. Not "are you technically allowed" but "does this make sense."
What Agentic AI Enables
Consider an access governance system with an AI agent:
Request-time interrogation. When you request access, the agent asks why. Not a dropdown of pre-approved reasons — an actual conversation. It evaluates your answer against your role, your recent activities, and the sensitivity of the data.
Continuous purpose alignment. Once granted, the agent monitors usage. Are the queries consistent with stated purpose? Is the volume appropriate? Does the pattern match others with similar legitimate needs?
Anomaly escalation. When something doesn't fit, the agent doesn't just flag it — it asks. "You said you needed customer addresses for a marketing campaign, but you're pulling purchase histories. Can you clarify?"
Dynamic access adjustment. If the stated purpose is complete, access can automatically expire. If purpose evolves, access can expand — with explanation.
The Privacy Paradox
Some will argue this is surveillance. Fair point. An AI monitoring your data access is watching what you do.
But here's the paradox: this monitoring enables less restrictive access. If I can verify your purpose and trust your usage patterns, I don't need to lock everything down by default. I can grant broader access to people demonstrating legitimate need, while maintaining tighter controls on anomalies.
The alternative is what we have now: blanket restrictions, cumbersome approval workflows, and people hoarding data in local spreadsheets because the access control system is too annoying to use properly.
Purpose-based access isn't more surveillance — it's smarter surveillance that lets legitimate users work freely.
Why This Is Hard
Purpose-based access sounds elegant in theory. In practice, several challenges emerge:
Exploratory work doesn't fit neat boxes. Legitimate data access often involves iterative discovery. A support engineer investigating a customer complaint may not know which systems or tables they'll need until they start following the trail. Requiring precise purpose statements up front kills this kind of diagnostic work. The AI needs to distinguish between legitimate exploration and fishing expeditions—a judgment call that even experienced data stewards struggle with.
The spirit of access is culturally contextual. What constitutes "appropriate use" varies dramatically by organization, industry, and regulatory environment. A healthcare analyst accessing patient records for population health research operates under different norms than a retail analyst mining purchase patterns. The AI needs to learn these local standards, not apply generic rules. This means purpose-based systems must be trained on organization-specific data and continuously refined as norms evolve.
Adversaries will game the system. Once access requires plausible explanations, sophisticated attackers will provide them. Social engineering becomes "I need customer contact data for the Q2 retention campaign" instead of "give me admin access." The AI must evaluate not just the stated purpose but the behavioral patterns that follow. Is this user's activity consistent with others doing similar work? Do the queries match the explanation? This requires baseline modeling of legitimate behavior—and attackers who've studied those baselines will craft their activities to blend in.
Audit and compliance get murkier. Traditional access control offers clean audit trails: "User had Finance role, policy grants Finance read access to general ledger, access granted." Purpose-based access introduces probabilistic reasoning: "User stated purpose aligned with role, usage pattern matched legitimate examples with 87% confidence, anomaly score below threshold." When regulators or auditors ask "why did this person have access?" the answer becomes more nuanced—and potentially more defensible, but definitely more complex. Organizations need to decide what level of AI-driven decision-making they're comfortable documenting and defending.
False positives will erode trust. If the system flags too many legitimate users as suspicious, people will find workarounds—local copies, shadow IT, data hoarding. The AI needs to be calibrated conservatively at first, favoring false negatives (missed anomalies) over false positives (wrongly blocked users). But that calibration is itself a judgment call about acceptable risk.
Where to Start
If you're thinking about purpose-based access:
1. Start with high-sensitivity data. Don't boil the ocean. Pick your crown jewels and build purpose-based controls there first.
2. Train on legitimate use. Your AI needs examples of what appropriate access looks like. Existing usage logs, with human labeling of legitimate vs. suspicious, are gold.
3. Keep humans in the loop. For now. Let the AI recommend and escalate, but have humans make final calls on unusual requests.
4. Document the spirit. What is this data for? What purposes are explicitly legitimate? What's clearly out of bounds? Your AI needs this context.
5. Iterate on feedback. Users will complain when access is wrongly denied. Good, that's signal. Use it to refine the model.
The Endgame
In a mature purpose-based access model, the question "do you have access to this data" becomes almost meaningless. The real question is "do you have a legitimate purpose for this data right now."
Access becomes dynamic, contextual, and purpose-bound. Not a key that fits a lock, but an ongoing conversation about what you need and why.
We've been trying to build this for decades with rule-based systems that couldn't understand intent. Now we have systems that can. The question isn't whether AI should govern data access. It's whether we're ready to finally answer the question we've been avoiding: why do you need this?
Jonathan Care is Lead Analyst at KuppingerCole AG, covering identity, fraud detection, and AI in security.