Box adds security controls to govern AI agents working with enterprise content
Box Inc. today introduced security controls aimed at the artificial intelligence agents now working across enterprise content.
The controls apply to agents built in Box and to outside tools connected to it, including Anthropic PBC’s Claude, OpenAI Group PBC’s ChatGPT and Google LLC’s Gemini. Rather than run as a separate product, the controls sit at the content layer, where the files already are.
Box said that lets it vet and record each agent action, then block anything that falls outside set permissions. The company is aiming the release at customers that want to move agent use beyond small pilots into production.
The push targets a barrier Box’s own research flags as the main obstacle to agentic AI. In the company’s 2026 State of Enterprise AI report, 90% of information technology leaders surveyed named security, regulatory and trust concerns as the biggest reason they hesitate to give AI agents access to enterprise content.
