Securing the agentic enterprise with data lineage

Data lineage has become the new security perimeter in the age of agentic AI. That was the key finding of a report on agentic AI enterprise security published by MIT Technology Review Insights on November 4, 2026, in partnership with cybersecurity firm Cyberhaven. Data lineage is the technology that records and traces where data comes from and how it is used; only by being able to trace its origins all the way back can the trustworthiness and safety of AI-generated output be guaranteed.

The report laid out concrete scenarios involving data moving without verification and untraceable incidents. When a sales representative asks an AI agent for customer pricing information, the agent pulls data from multiple sources, including access-restricted pricing systems, internal communications, and stored quotes. Because the output looked accurate, another agent used it to draft a proposal—and across the two handoffs, not a single human review took place. The problem was only discovered after the proposal came to contain unapproved confidential and sensitive information. Even then, no one could trace which path the problematic data had taken into the workflow, or how it had spread across systems, files, and agents.

The report pointed out that as enterprises extend agentic AI into everyday work, they face the challenge of managing highly mobile, fragmented data that goes beyond static files—data that is constantly collected, copied, summarized, transformed, reused, and redistributed. Ultimately, the report concludes, AI security is not a matter of tools but a matter of data visibility. Data lineage, it explained, delivers the visibility required for governance, accountability, and trust without hindering AI adoption at scale.