The language of secure AI data access

AI systems that can plan, decide, and take actions on behalf of a user across multiple tools and data sources, often in loops, with minimal human oversight. Agents dramatically expand the blast radius of any data an LLM touches: a single prompt may read Salesforce, draft an email, and hit a third-party API before a human sees the result.

An authorization model where access decisions are made dynamically based on attributes of the user, the resource, and the environment (role, department, data classification, time of day, device posture). ABAC is the backbone of fine-grained data access — which is what makes it a natural fit for AI agents that need row-, column-, and cell-level control.

The employee behavior of using personal AI accounts — ChatGPT, Claude, Gemini, or any number of niche tools — to do real work with corporate data, typically outside the view of IT. BYOAI is the 2026 equivalent of Shadow IT, and Gartner projects it will be involved in more than 40% of enterprise security incidents by 2030.

A category of controls aimed at preventing sensitive information from leaving approved environments — whether via email, cloud storage, USB, or, increasingly, an AI prompt. Traditional DLP was built around keywords and file types and struggles with the dynamic, conversational shape of AI traffic.

The practice of replacing sensitive values with realistic but non-identifiable substitutes so that downstream consumers (a developer, a model, an analyst) can still do their jobs without ever touching the real record. Dymium applies dynamic masking at query time, so the data is safe before it ever reaches an AI tool.