Box Enhances Enterprise AI Governance with New Agent Security Features
Box introduces new security capabilities to govern AI agents, including guardrails, prompt injection detection, and access policies, to secure enterprise content.
Box has unveiled a suite of new security features designed to bolster enterprise governance over artificial intelligence agents interacting with sensitive company data. These enhancements aim to provide organizations with greater control and oversight, addressing key concerns around AI security and privacy.
The new capabilities include agent guardrails, which define specific permissions and limitations for custom Box AI agents based on content sensitivity and organizational policies. These guardrails can enforce label-based access controls, require approvals for deletion actions, and prevent external sharing of sensitive information. Furthermore, Box is introducing prompt injection detection to validate inputs before they reach AI models, identifying and enabling the blocking or alerting of suspicious attempts.
For third-party agents, Box is implementing oversight through its Model Context Protocol (MCP) Server. This allows administrators to set scoped permissions, such as restricting file creation to approved folders or blocking external sharing. These controls extend to agent classification-based access policies, enabling organizations to exclude content with specific classifications from being accessed or searched by AI agents.
Visibility and auditability are also key components of Box's new offering. Agent activity oversight provides insights into external AI agent actions on customer content, with threshold-based alerts to detect and respond to suspicious behavior. Comprehensive agent audit trails and session governance retain auditable records for every agent session, ensuring compliance and providing full session context.
These advancements are a direct response to the growing adoption of AI agents in the enterprise and the associated security challenges. Box's 2026 State of Enterprise AI report indicated that security and privacy concerns are the primary obstacles to widespread AI agent deployment, with 90% of IT leaders citing these as major barriers to granting AI agents access to enterprise content.
Box's approach embeds security directly into the platform where content resides, offering protections at the content layer. This ensures that every agent action is intentional, permissioned, and auditable, whether the agents are built within Box or connected via third-party platforms. The company emphasizes that these new controls do not require additional tools for deployment or management, simplifying adoption.
Organizations across various sectors, including financial services, healthcare, and legal, can leverage these features to secure sensitive data. For instance, financial firms can safeguard M&A analysis, healthcare organizations can protect patient data, and law firms can govern AI in contract analysis workflows, all while maintaining compliance and preventing unauthorized access or modification.
With these new security and governance capabilities, Box aims to establish a standard for deploying AI agents securely and at scale, enabling organizations to confidently embrace AI-driven workflows without compromising on data protection and regulatory compliance.