What is agent reach?
Glossary · AI agent and machine identity security
Short answer
Agent reach is everything an AI agent can get to, directly or through other identities, tokens and tools.
Why it matters
Reach is about authority, not activity. An agent can reach data it has never touched, and the day it is tricked or misconfigured, that data is exposed.
Most reviews look at what an agent did. Reach asks what it could do, which is the question that matters before something goes wrong.
What it looks like
An agent holds a token for a ticket system. That token can assume a role. The role can read a storage bucket. The bucket is part of the agent's reach, even if the agent only ever creates tickets.
In nerl0
The Security Graph shows reach as authority paths. Every step is an observed relationship, and "proven" describes the route, not that it was used. See Security Graph.