The Three-Body Problem of Data, AI, and Identity: Why the Future of Security Depends on All Three

In physics, the “three-body problem” describes how the motion of three celestial objects – such as the Earth, Moon, and Sun – becomes unpredictable as their mutual gravitational interactions come into play. Each object affects the others in complex, often chaotic ways.

Today’s enterprises face a similar dynamic, only the forces aren’t planetary. They’re data, identity, and AI.

Each one is powerful on its own. Together, they create a new gravitational system for modern security and governance – unpredictable, interdependent, and full of risk.

Identity: The Original Risk Vector

At the heart of nearly every data breach or compliance failure lies one root cause: who has access to what.

Unauthorized or over-privileged access remains one of the biggest security gaps in any organization. Employees, contractors, and third-party users often have far more access to sensitive data than they need. Managing that sprawl of permissions has given rise to entire security categories: Data Security Posture Management (DSPM), Data Loss Prevention (DLP), Data Activity Monitoring (DAM), and Data Access Governance (DAG) – each tackling a different dimension of the problem:

• DSPM helps uncover where sensitive data lives and who can access it.
• DLP monitors how data moves and prevents it from leaving approved boundaries.
• DAM watches how users interact with data in motion—querying, viewing, or copying it.
• DAG governs entitlements to keep access aligned with least-privilege principles.

Each focuses on a different aspect of identity risk. But the through-line is clear: security starts with understanding who has access and how that access is used.

Data: The Hidden Risk Behind AI

In the era of generative AI, data itself has become the risk vector.

When organizations train large language models or deploy retrieval-augmented generation (RAG) systems, sensitive data can slip into AI pipelines, whether by design or by accident. Once that data is embedded in model parameters or vector stores, it can be difficult, if not impossible, to contain.

Sensitive information that makes its way into an AI model can reappear in unpredictable ways: through prompts, outputs, or even downstream agents that reuse the model.

The challenge isn’t just about model vulnerabilities – it’s about data exposure at a massive scale.

AI: The New Access Layer

AI is no longer just a tool; it’s a participant in data access.

Every prompt, co-pilot, or autonomous assistant represents a new kind of identity – an agentic identity – with the ability to read, write, and generate information on behalf of humans. These non-human actors can connect to corporate data stores, issue API calls, and make decisions in real time.

Organizations will need to manage and monitor not only human identities, but also non-human agents – each requiring authentication, authorization, and continuous governance. The same principles that apply to users will soon apply to AI.

The Three-Body Security Problem

When data, identity, and AI interact, they create a feedback loop that’s difficult to predict or control:

• Humans and agents access data directly and indirectly through AI.
• AI systems are trained on corporate data that may contain sensitive information.
• Models and agents can, in turn, share that data with other humans—or other AIs.

It’s a closed ecosystem of access, exposure, and amplification – a three-body problem for modern security teams.

As with the Newtonian version, the system is inherently unstable. Adjust one variable – like revoking access, changing a policy, or updating a model – and it can have unpredictable effects across the rest of the system.

Solving for Stability: Unifying Data, Identity, and AI

To bring order to the chaos, organizations need an integrated approach that connects these domains instead of treating them as silos.

• Unified Identity Visibility: Map both human and agentic access across data and AI environments.
• Unified Data Intelligence: Continuously discover, classify, and control sensitive data—whether it’s stored, shared, or vectorized for AI.
• Unified AI Governance: Define who (or what) can interact with data through AI models, and under what conditions.

This convergence represents the next evolution of Data Security Posture Management (DSPM) – a future where data, identity, and AI governance are part of a single, interconnected framework.

The Path Ahead

Security, compliance, and governance can no longer orbit independently. Each exerts a gravitational pull on the others, and ignoring any one of them destabilizes the entire system.

The enterprises that thrive in the AI era will be those that treat data, identity, and AI not as separate challenges, but as a single ecosystem to govern together. Because solving the three-body problem of modern security isn’t about eliminating the chaos—it’s about bringing it into balance.