If you’ve used ChatGPT or Claude, you know how it works. You type a question, and it types an answer back. It’s like having a very smart assistant who only communicates through text.
But what if your AI assistant could do things? Not just talk about a customer’s order, but actually look it up, check the return policy, and then draft a personalized email to the customer? That’s where a newer kind of AI comes in.
This is an AI agent (an AI system that can understand a goal, break it into steps, and then use various tools to complete those steps). Think of it as an AI that doesn’t just think but also acts.
The problem with AI that just talks
For simple chatbots, the security challenge was relatively straightforward. You feed it a chunk of information, and it answers based on that. If you wanted to make sure it didn’t share sensitive data, you filtered the information before it even saw it. We called this Retrieval Augmented Generation (RAG) (an AI technique where the system looks up information from a knowledge base before generating an answer). It worked well.
But AI agents are different. They don’t just retrieve information and talk. They interact with your actual business systems. They might query an order database, check inventory, or even update a customer record. This multi-step process means a single security checkpoint isn’t enough. It’s like having one bouncer at the front door when you need security guards in every room, watching every interaction.
Honestly, this confused me for a bit when I first learned about it. Why couldn’t we just filter the data once, like before? The weird part is, agents don’t just read data. They discover what data exists, understand how it’s organized (its schema), construct database queries, retrieve information, and then synthesize a response or take an action. Each of those steps needs its own security check.
What is an AI agent, really?
Imagine you hire a new assistant. You don’t just want them to talk; you want them to get things done. That assistant needs a list of tasks they can perform (like “look up customer,” “send email,” “check inventory”). These tasks are what we call tools in the AI world (specific capabilities an AI agent can use, often connecting to existing business systems through an API – a standardized way for computer programs to talk to each other).
Your assistant also needs access to various databases and systems, but only the ones relevant to their job. And they need to know exactly what they’re allowed to do in each system. An AI agent is similar. It takes your high-level request (“Handle this customer return”) and breaks it down into smaller, actionable steps:
- Find the customer’s order.
- Check the return policy for that item.
- Calculate the refund amount.
- Draft a return label.
- Send an email to the customer.
Each of these steps might involve using a different “tool” and accessing different parts of your company’s data.
The new security challenge: Governing AI agents
The old RAG approach worked because the AI only read from a pre-defined set of documents. It was passive. AI agents are active. They can discover new things and construct their own queries. This means security can’t be an afterthought. You need controls at every single point an agent interacts with your data or systems.
Think of it this way: if your human assistant needs to look up customer addresses, they get access to the CRM (Customer Relationship Management) system. They don’t get access to your raw financial ledgers. And they certainly can’t just delete customer records without specific permission. AI agents need the same level of granular control.
This is where a data mesh comes in (a way to organize and manage your company’s data where different business departments “own” their specific data, but everyone follows common rules for how data is accessed and secured). It’s like having specialized library sections for each department – finance has its own section, sales has its own – but there’s one central librarian who sets the rules for who can access what, and when.
How a data mesh powers secure AI agents
A data mesh helps break down the big, centralized data silos that often plague large organizations. Instead, each business domain (like “Order Management” or “Customer Support”) becomes responsible for its own data. They ensure it’s high quality and available. But here’s the crucial part: a central governance team defines how that data can be accessed and who can access it.
This means when an AI agent needs to interact with data, it doesn’t just get a blanket permission. It goes through a system that checks its credentials, its purpose, and the specific data it’s trying to touch. This central control is managed by services like AWS Lake Formation (a service that manages permissions for data lakes, letting you set detailed security rules for who can see which tables, columns, or even rows of data). Lake Formation acts like that central librarian, verifying permissions on the fly.
For example, your Order Management team might store all its transactional data in Amazon S3 Tables (a type of cloud storage that offers database-like features, including transaction support and advanced data management, built on top of Amazon S3). Lake Formation can then apply rules like “only the customer service agent can view order details for their own customers, and they can’t see credit card numbers.” This level of detail is critical.
An example: The customer service agent workflow
Let’s walk through how this might look for a customer service agent handling a return request.
The customer interacts with an AI agent hosted on Amazon Bedrock AgentCore (a secure, managed service on AWS for deploying and running AI agents). This agent needs to perform several steps to help the customer.
First, the agent tries to look up the customer’s order. It sends a request to a Gateway Layer (a security checkpoint that intercepts all requests before they reach the actual tools). This gateway checks if the agent is even allowed to use the “look up order” tool for this customer. It might validate the agent’s identity and ensure it’s not trying to do something suspicious, like a “prompt injection” attack (where a user tries to trick the AI into doing something it shouldn’t).
*The AgentCore Runtime sends a request to the Gateway Layer, which then calls the appropriate Lambda-backed tool.*If the gateway approves, it passes the request to a specific Lambda-backed tool (a small piece of code that runs on demand, acting as a “tool” for the AI agent to perform a specific action). For example, a get_user_tables tool might be called to see what customer data is available, or run_query to actually fetch order details. These tools then interact with the Governed Data Mesh.
This mesh includes:
- S3 Tables with Apache Iceberg: For structured data like customer profiles and order records.
- Amazon Athena: A query service that lets you analyze data in S3 Tables using standard SQL.
- AWS Lake Formation: The core security layer, enforcing row, column, and even cell-level security on the data.
- Amazon S3 Vectors: A cost-optimized way to store unstructured knowledge (like policies and FAQs) for semantic search. This can reduce vector storage and query costs by up to 90% compared to specialized vector database solutions in moderate query-frequency workloads, according to a 2026 AWS Machine Learning blog post.
When the agent’s run_query tool asks to see an order, Lake Formation checks its permissions in real-time. If the agent is only allowed to see orders from the last 30 days for customers in a specific region, Lake Formation enforces that. This means the agent never even sees data it’s not authorized for. This is a huge leap in security compared to simply filtering results after they’ve already been retrieved.
Why this matters to you
This isn’t just about technical plumbing. It’s about risk management and unlocking new value.
- Reduced Risk: By enforcing fine-grained security at every step, you drastically reduce the chance of an AI agent accidentally (or maliciously) exposing sensitive company or customer data. This protects your brand, avoids compliance penalties, and safeguards customer trust.
- Scalable Operations: You can safely deploy many AI agents across different departments, knowing that each one operates within its defined boundaries. This allows you to automate more complex workflows without constant human oversight for every data access.
- Cost Efficiency: Using services like Amazon S3 Tables with built-in Apache Iceberg support can deliver up to 10 times higher transactions per second compared to self-managed Iceberg tables, as noted by AWS. And as mentioned, S3 Vectors can cut costs for knowledge bases. These savings add up, especially as AI usage grows.
- Faster Innovation: With a secure data foundation, your teams can experiment with and deploy new agentic AI applications much faster. They don’t have to rebuild security every time, because the data mesh provides a common, governed framework.
This move from AI that just talks to AI that does things is a big one. It means your AI can truly become an active participant in your business processes. But for that to happen safely and effectively, the underlying data architecture needs to be just as sophisticated as the AI itself. A modern data mesh strategy, especially when built on a platform like AWS, provides that crucial foundation. It’s how you ensure your AI agents are not just smart, but also responsible and secure.
[1] AWS Machine Learning Blog, “Building agentic AI applications with a modern data mesh strategy on AWS,” June 25, 2026. Available at: https://aws.amazon.com/blogs/machine-learning/building-agentic-ai-applications-with-a-modern-data-mesh-strategy-on-aws/