Immuta has released updates and enhancements to its Data Marketplace solution. It is positioning them as accelerating secure data provisioning and improving data governance. The Data Marketplace makes it easier for users to find data and request access to it. It allows enterprises to offer access to data to users as they seek to get greater insight from enterprise data.
Matthew Carroll, co-founder and CEO of Immuta, said, “Historically, data governance was about control – managed manually by a select group of technical experts. But the landscape has changed. Today, every employee, every enterprise application, and every AI agent demands instant access to data, which is driving a significant surge in data access requests and complexity.
“What was once a human-driven process will soon be fully AI-powered – making access requests, running analyses, and acting on data at an unprecedented scale. Internal data marketplaces are becoming the de facto solution for streamlining the secure delivery of the right data to the right person, and managing complexity at such a scale.”
What is Immuta seeking to address?
Immuta says that among the new features are timebound approvals, dynamic domain assignments and new policies to improve data access workflow. These are all designed to improve data governance with automated access, provision and data sharing. They also enable the creation of an internal data marketplace for data sharing and access.
While the primary focus is making data access easier for users, there is an important secondary issue here. That is, control of data access for AI. The use of agentic AI to carry out tasks for users creates significant challenges in terms of security. The speed with which AI can access and summarise data means that existing security tools struggle.
Today, most data access tools are geared to role-based access controls (RBAC). These come with their own challenges around data security. One of the big questions over agentic AI data access is, what rights will it have? Will it inherit the users’ access rights? Will it be able to request elevated privileges if it deems them necessary to complete a task? That brings a series of risks with it.
In addition to access controls, security teams also use technologies such as behavioural analysis. Part of this looks at the times users are active and seeks to spot anomalous behaviour. As users make more use of AI, it is not unreasonable that they will seek to let it carry out tasks overnight. That means that time as a security measure becomes questionable.
This is where the new features in Data Marketplace come in. They offer potential solutions to some of these challenges.
A closer look at the new features
Each of the four key features that Immuta has announced can be mapped to data controls for both users and AI.
Timebound approvals
This allows data access to have start and finish times. Data administrators provide a user (individual or AI) with access to the data between certain times. Most current data access policies do not have a time limit. Once users have access, it tends to sit there for long periods of time, even when not required. That creates a risk of unauthorised data access over time.
Limiting access times also requires users to make use of data when they have it. It increases productivity if, and this is important, the process for requesting access itself functions efficiently. Immuta says it will because it is an automated system. What is not clear is what level of logging and auditing it comes with.
Dynamic data domain assignment
When creating data marketplaces, there is pressure to make all data available to as wide a group of users as possible. It’s termed data democratisation. However, it also leads to inappropriate access being given to data. From a compliance and governance perspective, this creates an immediate fail.
This feature will allow data engineers who are creating shareable data sets and applications to add controls on where they can be consumed. It is an addition layer of access control that prevents data leakage.
It does not prevent data being shared but, taking the example of medical billing. When bills are created and sent to an insurer for payment, they can see the procedure and what was consumed and is chargeable. However, they cannot see highly sensitive medical data related to a patient.
Prevention policies
These are a higher level of data protection that ensures that even if a user is granted access to data if they should not be able to see it, they can’t. For example, a set of data is made available to a research team. However, that team also works closely with outside contractors who should not see highly sensitive internal data.
Another example is one we have had ever since collaborative systems such as SharePoint appeared. Users will create SharePoint libraries where they will put any documents they think are relevant to everyone. They often have little understanding or care of the details of data security.
Prevention policies will allow security teams to tag data so that even if it is copied to a shared workspace, access controls will continue to prevent data leakage.
Customisable request forms
To allow users to request access to data means having a system for making requests. If it is too static or limited, it becomes a blocker, and users will find workarounds.
This option allows the data owner to require users to complete a set of questions before they grant access. There are four answer types as standard with this solution, giving data owners the freedom to vary the questions and seek greater detail on expected use.
Enterprise Times: What does this mean
All of the above actions can be applied to an individual, a group or an AI agent. They provide a flexible approach to a data marketplace that will allow enterprises to improve data sharing. That is a major goal for many organisations as they seek greater insight from the vast quantities of data they hold. The challenge, to date, has been how to do this in a secure manner that doesn’t inhibit use.
All of the above features in Immuta’s Data Marketplace support a wider but more secure sharing of data. However, it will be interesting to see how quickly organisations adopt them and begin to build out a wider data marketplace. There will be a need to revisit existing processes and how data is shared. If these tools are applied to that, it will cause some short-term frustration for users, especially the timebound approvals.
However, without these tools, many organisations will continue to struggle with data security. And with AI demanding ever greater access to data, there is a need for controls that can be implemented now.
