Authentication Is Not Authority: Joe Lichtenberg and Benjamin De Boe on Giving AI Agents Safe Access to Operational Data
Q1. For years, the enterprise data conversation was dominated by getting data into centralized stores — warehouses, lakes, lakehouses. You describe the current shift as the inverse challenge: organizations now need to get data safely out to empower AI agents. What specifically breaks when an organization tries to give an agent access to data that has been optimized for storage and batch analytics rather than for real-time, governed, agent-driven action?
Many platforms store delayed copies of the business. Agents need current state: the active order, claim, account, patient, or shipment status. They also need context that includes business rules, permissions, transaction boundaries, and process state.
Those gaps become operational risks when an agent can act. Stale data drives bad actions. Copies add security and reconciliation work. Cross-system processes can fail midway, leaving duplicate or partial updates. For example, an agent rebooking a shipment reads inventory from a nightly replica, commits the change through one API, times out on the second call, and retries—creating a duplicate booking against stock that no longer exists. Production systems need governed access to live data and approved tools, with transactions, durable state, retries, exception handling, audit trails, and risk-based approvals.
Q2. Agentic AI is often discussed purely in terms of model capability — reasoning, planning, tool use — while the underlying data management problem gets far less attention. What are the specific requirements that emerge once you take seriously the idea of agents needing “safe, secure, and governed access to trusted operational data” across silos — and how is that fundamentally different from the access patterns that traditional BI, reporting, or even earlier ML systems required?
BI is mostly read-oriented: authenticate, apply row or column controls, run a query, return a result. Earlier ML used bounded pipelines with defined inputs and outputs. Agents can select tools, combine context, retain state, and initiate actions. The control question shifts from “what can this identity read?” to “what is it allowed it safely invoke, with which parameters and conditions, and how can the action be audited or reversed?”
That requires live operational context, least-privilege access to data and tools, credential isolation, policy enforcement near the data and business logic, consistent schemas and semantics, transactions, idempotency, durable state, approvals, audit records, and data-location controls. Because context spans databases, applications, messages, APIs, and partners, interoperability is part of governance—not separate plumbing. In practice, this means exposing narrowly scoped tools such as “reschedule appointment” or “place payment hold,” with validated parameters and server-side policy checks, rather than raw SQL or broad API credentials.
Q3. You describe a converged architecture combining real-time transactional-analytic data management, integration, workflow orchestration, and vector and agentic capabilities under unified security and governance. In regulated industries like healthcare and financial services, that convergence carries real weight — but convergence can also mean added complexity. What is the honest trade-off organizations should understand between a unified platform approach and a best-of-breed architecture when it comes to giving agents governed access to operational workflows?
The trade-off is consolidation versus specialization. A unified platform can apply common controls across operational data, transactions, integration, workflow state, and agent tools. That reduces duplicate pipelines and policy mapping, especially for processes that must survive retries, approvals, handoffs, and failures. Developers can expose existing business logic as governed capabilities instead of rebuilding it in the agent layer. In InterSystems IRIS, for example, SQL and object access, vector search, embedded Python, workflows and integrations run on the same engine, so a tool can read current data, apply business logic, and write the result within one transaction, one security model, and one audit trail.
The cost is a broader conceptual and operational surface, without best-in-class specialization in every component. Best-of-breed can optimize each layer, but pushes complexity into the seams: identity propagation, policy consistency, observability, transaction boundaries, recovery, and audit evidence. In healthcare and financial services, those seams carry extra weight because a reviewer must be able to reconstruct which data, policy, and action were involved in a decision. This is not all-or-nothing. InterSystems IRIS complements models, agent frameworks, lakehouses, and systems of action by providing real-time operational context, interoperability, and durable workflow where those seams matter.
Q4. InterSystems has spent decades building for mission-critical, workflow-intensive applications in regulated environments — long before “agentic AI” was a term anyone used. What is the biggest misconception you encounter from organizations that are new to agentic AI but have not had to think seriously about risk controls, data sovereignty, or workflow governance before — the assumption that works fine in a low-stakes pilot but breaks down the moment agents touch real operational systems?
The biggest misconception is that authentication equals safe authority. An agent may be able to connect to an API but use an over-privileged service account or one that is disconnected from the application’s real roles and access policies. Also, it may lack the workflow context to know whether the action is appropriate, already in progress, subject to approval, or restricted by data-residency rules.
Pilots often use broad credentials, artificially clean data, short tasks, and constant human oversight. Production brings concurrent updates, duplicates, timeouts, partial failures, permission changes, and long-running work. Give agents bounded capabilities, not general access. Enforce deterministic rules and transaction controls, persist state, and require approval for consequential actions. The agent reasons; the platform controls and records execution. None of these controls are new. They already govern clinical messages and financial transactions; an agent is simply a new, less predictable caller that must pass through them.
Q5. You talk about making a powerful impact on the health of data across sectors — healthcare, financial services, supply chain and logistics. If you had to give a straightforward answer to the question “is your data healthy?” for a typical enterprise today, what would that honest answer actually be, and what are the one or two symptoms of unhealthy data that organizations most consistently fail to recognize until an AI agent exposes the problem for them?
For most large enterprises: healthy in individual systems, but not end to end. Data may be accurate at the source, but the enterprise often lacks a current, consistent, reconciled view of the entities an agent acts on—the customer, order, patient, or account.
Two common symptoms are semantic inconsistency and hidden staleness. Systems define the same customer, product, patient, account, or status differently. Teams know where a value lives, but not when it changed, how it was transformed, or whether it may be used for a given action. Agents expose these defects quickly because they combine data across boundaries at machine speed. A practical test: for any value an agent will use, can you state its source, freshness, and which identities may act on it? If not, the agent can’t either.
Q6. Joe, your background is in market strategy and product positioning; Benjamin, you describe your work as translating technology into stories that stick for both buyers and builders. Having spent your careers helping organizations communicate about complex data and AI technology, what is the biggest gap you each see right now between how agentic AI is being talked about publicly and what is actually happening inside real enterprise data environments — and has anything about that gap surprised you personally?
Joe: Agentic AI is being promised as enterprise-class, end-to-end process automation: agents that take a request, reason across systems, and carry the work through to completion. In practice, most production deployments are still narrowly scoped and supervised, handling retrieval, summarization, or a few well-defined actions. The gap isn’t model capability. “End to end” means crossing multiple systems of record, each with its own data, rules, permissions, and failure modes. “Enterprise-class” means transactional integrity, recovery, auditability, and clear accountability across that entire path. Those properties come from the operational platform the agent runs against, not from the agent framework. What surprised me is that the hardest blocker usually isn’t the model or the data. We are finding that many organizations still struggle to describe their own cross-system processes precisely enough for software to execute them. Exceptions, workarounds, and judgment calls are rarely documented, and agents force that knowledge to become explicit.
Benjamin: True. There’s also something dangerous about it in the sense that if you don’t make that process knowledge explicit, the agents will fill in the blanks themselves. Agentic development is a game-changing accelerator, but being able to generate your business requirements document doesn’t mean you should let all your business analysts go. It is now actually more important than ever to make sure that your specifications are comprehensive and to the point, given that code, interfaces, test scenarios and documentation may be generated straight from them. We see organizations at different levels of maturity with respect to agentic development, but the ones that are furthest along are typically the ones that already had well-organized processes defined. That’s probably not all that surprising a gap, but AI is clearly a catalyst for good engineering practices, not a substitute.
Qx. Anything else you wish to add?
Agentic AI makes proper data management practices more important, not less. Keep trusted data and business capabilities independent of any one agent runtime. Authority should remain close to the data and logic, capabilities should be exposed through defined interfaces, and every action should be recorded. Models and frameworks can then change without redesigning core operational systems. A good starting point is one high-value workflow with a small set of governed tools, measured on correctness and recoverability, not just task completion.
……………………………………………..
Joe Lichtenberg is the Director, Data Platform Product Marketing at InterSystems, where he leads worldwide marketing for the company’s data platform and data management software. He brings decades of experience working with technology vendors in data management, analytics, and cloud computing, with a specialized focus on the financial services sector.
Benjamin De Boe is the Manager of Analytics Product Management at InterSystems, where he oversees the strategy, scalability, and integration of analytics and database technologies. He joined the company in 2010 through the acquisition of iKnow and brings extensive expertise in data warehousing, natural language processing, and business intelligence. Benjamin holds a Master of Science degree in engineering from the University of Leuven, Belgium.
Sponsored by InterSystems.