Capability Overview
Varonis has shipped Agent Intent-Based Access Control (IBAC) as a new capability within its Varonis Atlas platform. The control operates at runtime: it compares the instruction an AI agent received from a user against the agent’s actual reasoning, tool invocations, and data access patterns, then takes graduated action when the two diverge. Responses range from logging low-risk drift to automatically blocking tool calls and quarantining the agent identity for a configurable window.
The motivation is clear and timely. Role-based access control was designed for human users making deliberate, bounded requests. AI agents operate differently — they require broad access to be useful, they chain tool calls autonomously, and they can act on data far outside the scope a human user would reach. Agent IBAC attempts to fill that gap by enforcing intent at the action layer rather than the permission layer.
For defenders, the capability represents a meaningful step toward runtime accountability for non-human identities. But any security control that interprets intent is itself an attack surface.
Attack Surface Analysis
Agent IBAC introduces several new vectors that security teams must account for:
Intent spoofing via prompt injection. The entire IBAC model depends on accurately resolving what a user intended. A well-crafted prompt injection — delivered through a document, email, or API response the agent reads — could reframe a malicious action as semantically consistent with a legitimate instruction. If the intent-matching logic can be fooled at the linguistic level, the guardrail becomes a bypass target rather than a control.
Threshold enumeration and drift-zone exploitation. Agent IBAC distinguishes between blocking actions and logging actions based on assessed impact. Adversaries who understand this tiering can probe the boundary systematically — submitting actions that sit just inside the logging-only band to conduct persistent low-velocity reconnaissance without triggering automated responses. The graduated response model, while operationally sensible, creates an exploitable grey zone.
Quarantine-as-denial-of-service. If the identity quarantine mechanism can be triggered by crafting specific agent behaviour patterns, an attacker with the ability to influence agent inputs could repeatedly cause legitimate agent identities to be quarantined, disrupting production workflows.
Supply chain risk to the intent classifier. If IBAC’s intent-alignment judgment relies on a downstream ML model or external API for semantic comparison, that component becomes a high-value supply chain target. Compromising or adversarially perturbing the classifier’s inputs would blind the entire control layer.
Framework Mapping
- AML.T0051 (LLM Prompt Injection) and AML.T0054 (LLM Jailbreak): Primary vectors for intent spoofing attacks against the IBAC matching logic.
- AML.T0015 (Evade ML Model): Relevant if the intent classifier is ML-based; evasion techniques apply directly to threshold probing.
- AML.T0043 (Craft Adversarial Data): Crafting inputs that manipulate the intent comparison output.
- AML.T0010 (ML Supply Chain Compromise): Targeting the intent-classification component upstream.
- LLM01 (Prompt Injection) and LLM08 (Excessive Agency): The two OWASP categories that Agent IBAC most directly addresses — and that adversaries will most directly target to circumvent it.
Threat Scenarios
Scenario 1 — Document-borne intent spoofing. An attacker embeds a prompt injection inside a PDF an agent is instructed to summarise. The injected text reframes the agent’s task in language that makes a subsequent credential exfiltration call appear to match the user’s original intent. Agent IBAC sees apparent alignment and does not block.
Scenario 2 — Slow-burn drift exploitation. A compromised agent performs a series of small, individually low-impact data reads across weeks — each falling into the log-only drift band. The aggregated access reconstructs a sensitive dataset without ever triggering a block.
Scenario 3 — Quarantine flooding. An attacker with access to an agent’s input channel deliberately induces out-of-policy behaviour, repeatedly triggering quarantine of a critical workflow agent and causing sustained operational disruption.
Defender Checklist
- Before production deployment, conduct adversarial red-team exercises specifically designed to make malicious tool calls appear intent-aligned through prompt crafting
- Audit which classes of agent actions fall into the logging-only (drift) band; apply additional detection logic to activity in that zone
- Confirm the quarantine mechanism requires authenticated signals and cannot be triggered by agent input manipulation alone
- Identify whether the intent classifier relies on any external ML service or API and apply supply chain controls to that dependency
- Establish baseline agent behaviour profiles and alert on statistical anomalies even when individual actions do not cross IBAC thresholds
- Do not treat Agent IBAC as a substitute for least-privilege provisioning — scope agent permissions as narrowly as possible before applying runtime controls