In a recent Data Faces podcast interview, QueryStory co-founder and CEO Shapor Naghibzadeh shared a simple principle for securing agentic systems:
“Treat the model the same way you would a complete adversary.”
For Shapor, that means moving beyond prompts and model outputs as the primary line of defense.
Start with zero trust for model output. An agent may generate code, execute it, access business data, and interact with the internet. Instead of trusting the model to stay within its intended boundaries, organizations should use infrastructure-level controls to define what an agent can and cannot do.
Limit the blast radius. Agents should have narrowly scoped permissions based on the job they're performing. If an agent doesn't need access to a table, system, or the internet, it shouldn't have that access.
Make the secure path the easy path. Security controls that create too much friction can drive people toward Shadow IT. IT and security teams need to provide governed tools that let employees get their work done without finding workarounds.
Rethink permissions for agents. Human access often assumes something about intent. An employee may need to look up customer information without needing the ability to export an entire customer database. Agents don't necessarily have that same implicit trust, which makes more granular controls increasingly important.
At QueryStory, this philosophy shapes how we use agents ourselves: specific agents, specific jobs, and permissions that constrain what they can do rather than relying on the model to make the right choice.
Watch the full conversation with Shapor to hear his take on agent security, zero trust, Shadow IT, permissions, and what organizations need to rethink as agents gain access to business data.