Most programs decide how sensitive an AI agent is by asking its owner. The owner fills in a form, or adds a tag to the agent's identity, and from then on the agent is treated as internal, confidential or regulated. That is a reasonable starting point, and it has a built-in weakness: it records intent, not reality.
The agent's real exposure is determined by what it can reach. An agent tagged as handling only internal data that has read access to a storage bucket full of customer records is a confidential-data agent, whatever its tag says. Nobody lied. Access drifted, as it always does, and the label stayed where it was.
The fix is to read both signals. The data resources themselves are usually already classified, because data governance programs tag buckets, storage accounts and datasets long before anyone thinks about agents. If an agent has been granted access to a resource labeled confidential, that fact should flow to the agent. When the two signals disagree, the stricter one should win, and the finding should name the resource that caused it.
Naming the resource matters more than it sounds. A finding that says an agent has access to confidential data sends an engineer on a search. A finding that names the bucket, and the grant that reaches it, can be fixed in minutes: remove the grant, move the data, or accept the risk and document it.
It also removes a common blind spot. Many data-loss checks wait for evidence of outbound traffic before raising an alarm. But an agent that can read confidential data is already a risk, before it sends anything anywhere. Raising that early costs nothing, and waiting for the exfiltration to appear in a flow log means the data has already moved.
CloudSentry AI resolves classification from the data an agent can reach on AWS, Azure and Google Cloud, names the specific resource in the finding, and raises it without needing outbound traffic as proof. Today it covers object storage; other data stores are on the roadmap.
A tag tells you what the team meant. The access list tells you what the agent can do. Governance has to start from the second.