> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-security/data-access-governance.md). # Data Access Governance Cortex Data Security enables Data Access Governance (DAG) by providing visibility into the relationships between identities and sensitive data across your cloud and identity estates. The platform calculates the effective permissions of every human and machine identity, helping you identify over-privileged access and enforce the principle of least privilege for your critical data assets. ## Net-effective permission calculation The platform calculates the effective permissions of an identity by resolving its assigned IAM roles, group memberships, and resource-level policies into the access it actually has. * **Identity Security dashboard:** Monitor your entire identity estate from a centralized dashboard that provides a unified view of identities, effective permissions, access paths, and over-privileged or high-risk access across cloud and SaaS environments. * **Identity-enriched security graph:** Visualize access paths across AWS, Azure, and GCP to see how human and non-human identities can reach sensitive data. * **Cross-environment access analysis:** Map permissions from identity providers (IdPs) such as Okta and Google Workspace to their downstream cloud resources. * **Effective permissions modeling:** Consolidate policies, group memberships, and resource-level permissions into a single allow or deny verdict. ## Least privilege enforcement The platform identifies excessive or unused permissions that increase your attack surface so you can remediate them. * **Unused access detection:** Audit and revoke permissions that have not been used for an extended period (for example, 90 or more days). * **Rightsize recommendations:** Provides data-aware recommendations to reduce the permissions of over-privileged service accounts and admin roles. * **Privileged identity monitoring:** Track shadow admins and high-risk machine identities that hold potentially destructive permissions on sensitive data stores. ## AI-aware access governance The platform extends identity controls to agentic workflows and AI-driven data access. * **AI agent monitoring:** Track and govern the permissions of AI agents that handle sensitive corporate information. * **Copilot readiness:** Generate reports to confirm that your Microsoft 365 or Google Workspace environment has the required data access controls in place before you deploy generative AI tools. * **Autonomous identity response:** Use playbooks to revoke access or trigger reviews when anomalous identity behavior is detected. {% hint style="info" icon="note-sticky" %} **Note:** For more information, see the [Cortex Cloud Identity Security documentation](/cortex-cloud-runtime-security/cortex-cloud-identity-security/what-is-cortex-cloud-identity-security.md). {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/data-security-documentation/data-security/data-access-governance.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.