Data Governance in the World of Agents#

Komal Mangtani (Meta)

• Why: Agents in production is a core interest, and this names precisely why human-era IAM breaks under machine-speed, parallel, persistent agents — identity confusion, entitlement creep, recursive leakage across agent chains — then gives a full defense-in-depth reference architecture.
• What: Meta's governance stack for production agents: Isolation Domains (domain-scoped encryption and output closure), Agent Identity (end-to-end attribution distinct from the user), Agent-Aware Access Control (classification-aware ABAC evaluated at query time), AccessMate (zero-standing-permissions triage), CodeGuard (secure codegen/execution guardrails), and DataVM (a unified trusted environment bounding inputs, tools, and outputs) (from abstract only).
• How: Rather than bolting IAM onto agent harnesses, controls are evaluated in the data path at query time with classification awareness, permissions default to least-privilege with no standing grants, and each agent action carries its own identity for audit — turning governance into the harness for autonomy.
• Where applicable: The named components are Meta's, but this is presented explicitly as a reference architecture, and the failure modes it catalogs (trajectory/embedding/log/tool-output persistence as new data surfaces) are universal to agentic systems. Directly reusable as a requirements checklist for any agent platform.