When autonomous AI agents act as an intermediary between users and secured data, traditional security models quickly fall short. The rise of agentic AI therefore requires a new approach to access management—one that considers not only who has access, but, more importantly, what an AI agent is allowed to do at any given moment.

In this presentation, Roche and Immuta will demonstrate how we are addressing this challenge. We will start by exploring Roche’s journey from a manual database access process to a dynamic, tag-based marketplace for data access. We will then look ahead to our approach to governing AI agents.

We will demonstrate how a custom MCP server can dynamically combine an AI agent’s permissions with the current access rights of the human user making the request. This makes it possible to determine exactly which data can be accessed at the moment a query is made.

Finally, we will show how this access control can be enforced at a granular level—for example, by masking columns in real time or filtering rows. At the same time, full visibility is maintained into who asked which question and what data was made available in response.
This creates a model in which AI agents can operate autonomously without compromising control, security, or transparency.

When autonomous AI agents act as an intermediary between users and secured data, traditional security models quickly fall short. The rise of agentic AI therefore requires a new approach to access management—one that considers not only who has access, but, more importantly, what an AI agent is allowed to do at any given moment.

In this presentation, Roche and Immuta will demonstrate how we are addressing this challenge. We will start by exploring Roche’s journey from a manual database access process to a dynamic, tag-based marketplace for data access. We will then look ahead to our approach to governing AI agents.

We will demonstrate how a custom MCP server can dynamically combine an AI agent’s permissions with the current access rights of the human user making the request. This makes it possible to determine exactly which data can be accessed at the moment a query is made.

Finally, we will show how this access control can be enforced at a granular level—for example, by masking columns in real time or filtering rows. At the same time, full visibility is maintained into who asked which question and what data was made available in response.
This creates a model in which AI agents can operate autonomously without compromising control, security, or transparency.