We're incredibly excited to announce the launch of Box agent security and governance controls, a purpose-built suite that gives customers the confidence to deploy AI agents safely across their enterprise content.
🔒 What is Box agent security and governance?
Box agent security and governance is the content-native protection layer built for AI agents operating on enterprise data. It detects and blocks prompt injection attacks before they reach the model, enforces admin-defined guardrails on what agents can do, and provides full auditability of every agent action. Because security is enforced at the content layer, governance travels with the file regardless of whether Box AI, Copilot, Claude, or a custom model initiates the request.
In short: Deploy AI agents with confidence. Your content stays protected.
🛡️ What's coming?
The suite brings together the controls admins need to govern both Box AI and third-party agents like Claude, ChatGPT, Copilot, and Gemini through the Box MCP Server. Here's what's on the way:
- Prompt injection detection, generally available now in log mode, with block modes coming later in 2026
- Agent guardrails and MCP guardrails to set boundaries on what agents can do, coming in 2026
- Classification-based access policies through Box Shield, rolling out in late July
- Agent activity oversight, agent audit trails, and session governance for full visibility, coming late 2026
📈 Why it matters
AI agents are moving from experiment to production fast. 83% of organizations are already testing them, but 90% of IT leaders say security is the top barrier to broader adoption.1 The risks are real: agents can be manipulated, take unauthorized actions like sharing or deleting files, and operate with zero audit trail, creating board-level risk that scales at machine speed. Today, we're giving customers a clear answer.
Industry analysts agree. Here's what IDC had to say:
"As organizations rapidly adopt agentic AI, securing the content layer becomes the critical foundation for deployment. Box's new security and governance controls address the primary barriers of privacy and unauthorized access directly where the data lives. By embedding guardrails, prompt injection detection, and human-in-the-loop oversight into the platform, Box is establishing a vital trust standard that allows enterprises to confidently scale both native and third-party AI agents across their most sensitive content." — Amy Machado, Senior Research Director, Content and Knowledge Management Strategies, IDC
📚 How can I learn more?
📖 Launch blog → Link
🎙️ Webinar → Register here
Join the Box agent security community roundtable event→ Link
Questions? Feel free to reply to this post.