We gave an agent one job: email our biggest prospect. A day later I checked what else it could open, and it could pull up our largest live renewal, pricing and all. Nobody set that up on purpose. Until I went looking, nobody could have told me it was true.
@forrester has been bracing for this. They expect an agentic AI deployment to cause a publicly disclosed breach in 2026, and to trace back to governance failures rather than sophisticated attackers.
This April it got real. Researchers showed that a prompt injection hidden in a customer-facing form could turn both
@salesforce Agentforce and
@Microsoft Copilot Studio into data-exfiltration tools. The data walked out, sent through a normal action the system saw no reason to block. The agent broke no rules. It used access it had been given, which is what made the leak so hard to spot.
You cannot patch your way out of that. The only thing that limits the damage is knowing, ahead of time, exactly what an agent can reach. Most companies cannot produce that list today.
Anyone who has run RevOps knows the request. Security or Legal asks who can see a given account and how they got there. You open the Sharing button in Salesforce, and next to half the names it just says "associated record owner or sharing". So you start opening rules, checking territories and guessing. A full afternoon gone and you still answer with "I think so." That is not a chain, it's a shrug.
There is a name for the thing that question is really asking for: Access provenance. For any record, the full set of who and what can reach it, and the exact path each one took to get there.
At
@rox_ai, that question takes one view. Pick any account and you get every identity that can reach it, person or agent, with the path each one took.
In the video, I show how this works in Rox. I set up an outbound agent with one job to outbound to just one account.
Then I ran it on an account the agent was never pointed at. It came back reachable. The trace showed why in seconds. That same agent was sitting in a broader team too, left from a RevOps change months ago, and GTM West rolls up to it through a user-based hierarchy. A rep on that team owns the account, so access ran straight up the chain to the agent.
I caught it before the agent ever ran.
Read the same graph backward and it answers the other half: everyone, every person and every agent, who can reach a record, and the route each of them took.
Access provenance is the layer nobody bothered to make legible, because until an agent was acting on it at speed, you could get away with not knowing. That era is over. We are building Rox enterprise-ready so this is the first thing you can answer about your data, not the last.
Kudos to the platform team that worked on making the boring parts of enterprise software so "cool". We are hiring!
jobs.ashbyhq.com/Rox-Data-Co…