Search for "access control software," and the top results sell physical badge readers, keycards, and turnstiles. Essential for facilities, but completely irrelevant to enterprise data risk.
What security leaders are actually trying to solve is data access control: the software that governs who can open specific information, from which device, under what conditions, and logs every request along the way. Most enterprises already pay for three or four products claiming to solve this exact problem.
Yet sensitive data leaks every single day from fully compliant, highly audited environments.
The problem isn't that your access controls are failing; it's that they stop working the moment data leaves its native environment.
Consider a scenario that plays out in almost every enterprise: A Senior VP exports an unredacted M&A model from SharePoint to review offline during a flight. SSO verifies their identity, Conditional Access approves the compliant laptop, and the DLP scanner logs a routine download. Two weeks later, a secondary copy of that same file gets forwarded to an external deal team's unmanaged drive.
Nothing broke. Every tool performed as configured: they authorized the person to enter the repository. But not a single tool stayed with the file once it crossed the perimeter.
That boundary gap is where enterprise risk actually lives. Data access control isn't a single product category; it's five distinct functional layers. Applying the wrong layer to solve an off-perimeter file problem is the most common structural mistake security teams make.
❌ Your Access Controls Stop at the Download Button
Identity platforms govern repository authentication. They exert zero influence over a file once a session downloads it. If your files don't enforce their own policy, the final enforcement layer of your stack doesn't exist.
What Counts as Data Access Control Software
Data access control software answers three questions about every request for data: who is asking, what are they allowed to see, and under which conditions. The better tools add a fourth: what evidence exists afterward.
What it is not: physical access control (readers and door locks), or network access control (which devices can join a network). Those protect buildings and pipes. This list covers the tools that protect data.
One disclosure before the list. Theodosian sells in one of these layers, and we have a point of view. We have tried to describe every tool, including ours, by what it controls and where it stops. Where a competitor does something we don't, we say so.
The Five Layers of Data Access Control
Each layer answers a different question, and each one stops somewhere specific.
| Layer | The question it answers | Example tools | Where it stops |
|---|---|---|---|
| 1. Identity and privileged access | Is this person who they say they are, and should they reach this application? | Okta, Microsoft Entra ID, SailPoint, CyberArk | The application or repository boundary |
| 2. Data platform access | Which rows and columns can this user query? | Immuta, Privacera, Satori | The data platform (warehouses and lakes) |
| 3. Policy and authorization engines | Does this request satisfy our attribute-based policy right now? | Axiomatics, NextLabs | The applications and systems that call the engine |
| 4. Governance and visibility | Who has access to what, and is it too much? | Varonis, Microsoft Purview, SailPoint File Access Manager | Discovery and recommendation, plus enforcement inside the governed environment |
| 5. File-layer access control | Enforces real-time access controls, identity verification, and context checks directly on the object itself—wherever it travels. | Theodosian, Seclore, Fasoo, Virtru, Kiteworks | Varies by tool (see below) |
Most enterprises need two or three of these. The mistake is assuming the first four cover the fifth. According to Gartner research on unstructured data management, up to 80% of enterprise data is unstructured. That means files are the exact objects that layers 1 through 4 lose track of the moment they are downloaded, attached, or synced outside governed systems.
Layer 1: Identity and Privileged Access
Identity platforms manage authentication across the enterprise stack. They establish who is allowed into an application environment, and they execute that function reliably.
Okta
Okta handles workforce and customer identity: single sign-on, multi-factor authentication, and lifecycle management across hundreds of applications.
Strengths: Broad application integration, mature policy options, strong adoption.
Where it stops: Okta decides whether you reach SharePoint. It does not decide what happens to the contract after you download it.
Ideal for: Any enterprise that needs one consistent login and MFA policy across its application estate.
Microsoft Entra ID
Entra ID pairs identity with Conditional Access, evaluating user, device, location, and risk signals before granting access to Microsoft 365, Azure, and connected apps.
Strengths: Native to the Microsoft stack, deep conditional access policy options.
Where it stops: Conditional Access governs the session. A file downloaded to a device outside Intune management, or shared outside the tenant, is outside its reach.
Ideal for: Microsoft-centric organizations.
SailPoint
SailPoint is the leading name in identity governance: access requests, certifications, and role modeling. Its File Access Manager extends that governance into file store permissions, showing who can reach which sensitive files and removing over-privileged access.
Strengths: Access reviews at scale, and unusual reach into unstructured data permissions for an identity vendor.
Where it stops: It governs who holds permissions on file stores. It does not encrypt the file or control a copy that has left the store.
Ideal for: Enterprises with heavy audit and access certification workloads.
CyberArk
CyberArk specializes in privileged access: administrator accounts, service accounts, and machine identities, with session recording and credential vaulting.
Strengths: Protects the highest-value credentials in the company.
Where it stops: It secures the keys to systems. The files those systems hold are a separate question.
Ideal for: Organizations where a compromised admin account is the scenario that keeps the security team up at night.
Layer 2: Data Platform Access Control
If your sensitive data lives in Snowflake, Databricks, or a warehouse, this layer is the right one, and Theodosian is not. We protect files. We do not encrypt or govern database rows.
Immuta
Immuta enforces policy-as-code on cloud data platforms, including row-level filtering and column masking across Snowflake, Databricks, Redshift, BigQuery, and others.
Where it stops: The warehouse. A report exported from a governed table into a spreadsheet becomes a file, and the policy stays behind.
Privacera
Privacera centralizes policy for access and masking across cloud and hybrid data estates, built on Apache Ranger.
Where it stops: Same boundary. Policy governs queries, not the exports those queries produce.
Satori
Satori discovers and classifies sensitive data without agents and enforces access in real time for teams working in modern data warehouses.
Where it stops: The warehouse perimeter, again.
Ideal for all three: Data and analytics teams whose risk sits in structured data at scale.
Layer 3: Policy and Authorization Engines
These tools externalize the decision. Applications ask the engine, "may this request proceed?" and the engine evaluates attribute-based policy: who the user is, what the data is, what the context looks like.
Axiomatics
Axiomatics provides dynamic, attribute-based authorization for applications, APIs, and data, with policy managed centrally and decisions evaluated at request time.
Strengths: Precise ABAC, flexible policy framework.
Where it stops: It decides only for systems wired to call it. A file outside those systems is outside its decisions.
NextLabs
NextLabs applies attribute-based policy through enforcers for SAP, Salesforce, Snowflake, PTC Windchill, and, as of July 2026, AWS S3, including dynamic data masking.
Strengths: Breadth of enforcers for enterprise systems, strong in engineering and supply chain data.
Where it stops: Coverage follows the enforcers. Each new system or file destination needs its own.
Ideal for both: Enterprises with complex application estates and a dedicated authorization team.
Layer 4: Data Governance and Visibility
You cannot control access to what you cannot see. This layer finds sensitive data, maps who can reach it, and flags exposure.
Varonis
Varonis discovers and classifies sensitive data, analyzes permissions, and detects abnormal access behavior across file shares, SharePoint, and cloud stores.
Strengths: The deepest visibility into who can reach what across unstructured data.
Where it stops: Varonis shows you where the file is and who touched it. It does not encrypt it, and once a file leaves the systems Varonis monitors, visibility ends. Read the full comparison: Theodosian vs Varonis.
Microsoft Purview
Purview combines sensitivity labels, DLP, and insider risk management for Microsoft 365, with label-based encryption and rights controls in supported Office formats.
Strengths: Native integration with Microsoft apps, bundled with E5 licensing for many enterprises. Where it stops: Protection is strongest inside the Microsoft ecosystem and varies by file format. Files that move to non-Microsoft platforms lose most of it. Even with customer-managed keys, Microsoft retains tenant keys. See Theodosian vs Microsoft Purview.
Ideal for both: Enterprises that need to map and reduce permission sprawl before anything else.
Layer 5: File-Layer Access Control
This is the layer missing from most enterprise architectures. It enforces access decisions continuously, even after a file is downloaded, attached to an email, or opened on an external device. By binding policy directly to the underlying data rather than the host repository, these tools ensure access control stays active wherever the object resides.
Theodosian
Theodosian encrypts each file with its own FIPS 140-3 validated AES-256 key and evaluates access on every open: identity, device, location, and time of day. The policy travels with the file into SharePoint, Google Drive, Dropbox, an email attachment, or a contractor's laptop. Revocation applies to every copy. When behavior looks anomalous, such as a bulk download at 2 a.m., Drop the Gate freezes access automatically. The architecture is zero-knowledge: keys are generated client-side, so Theodosian cannot decrypt your files. It is patent-pending, runs on FedRAMP Moderate infrastructure, and deploys over your existing stack in days with no migration.
Strengths: Per-file keys, zero-knowledge architecture, autonomous response, in-use encryption, governed access for AI tools, and an invisible user experience.
Where it stops: Theodosian controls who can open a file and under what conditions. It does not prevent an authorized user from copying or printing the content once it is open. Rights management is on the roadmap, alongside discover and classify.
Ideal for: Enterprises that share sensitive files with people and systems outside their control and want the protection to travel.
Seclore
Seclore is an enterprise information rights management platform applying persistent controls to documents, including the ability to restrict copy, print, and save-as once a file is open.
Strengths: Real rights management today. If you need to stop a user from printing or screenshotting an open document, Seclore does that, and Theodosian does not yet.
Where it stops: Implementation is a larger project involving policy design and workflow changes, and restrictions can create user friction.
Ideal for: Large enterprises with IP protection requirements where usage restrictions are a hard requirement.
Virtru
Virtru began with email encryption and has extended into file-level protection through Virtru for Desktop and, as of May 2026, Virtru Collaborate, built on the Trusted Data Format with attribute-based access control.
Strengths: Strong email experience, an open data format, and a growing file-level story.
Where to probe: Ask how policy is enforced per file outside email workflows, what happens automatically when behavior turns anomalous, and how AI tool access is governed. See Theodosian vs Virtru.
Ideal for: Organizations whose sensitive data moves mostly through email and Google Workspace.
Kiteworks
Kiteworks unifies secure file sharing, email, managed file transfer, and web forms in one governed platform, with centralized policy, audit logging, and expiring access for external recipients.
Strengths: One governed channel for sensitive exchange, with strong audit evidence.
Where to probe: Control is strongest for files that move through the platform. Ask what protects a file that was downloaded from it and forwarded outside it.
Ideal for: Enterprises that want to consolidate external file exchange into a single governed system.
How the Five Layers Compare
| Capability | Layers 1–3 (Identity, Data, Policy) | Layer 4 (Governance) | Layer 5 (File-Layer) |
|---|---|---|---|
| Decides who gets in | Yes | Recommends and maps | Yes, per file |
| Covers structured data in warehouses | Layer 2 yes, Layer 3 partly | Partly | No (Theodosian protects files, not databases) |
| Covers files in SharePoint and Google Drive | Permission level only | Visibility plus permission cleanup | Yes, encryption and policy on the file |
| Enforces after download or forward | No | No | Yes, where protection travels with the file |
| Revokes access to copies already shared | No | No | Yes (varies by tool) |
| Evidence per file, per access | Partial | Strong visibility | Yes |
| Works when credentials are stolen | Only if anomaly is detected | Detects, does not block | File policy still has to be satisfied |
Why Every Layer Above the File Eventually Stops
Traditional security tools treat data access like building security: if you have the right badge, you get into the room, and you can touch whatever is on the desk. Layers 1 through 4 excel at verifying that badge.
The flaw is that modern breaches rarely start with someone picking the lock. Year after year, Verizon’s Data Breach Investigations Report shows that roughly 80–90% of breaches involve stolen credentials, social engineering, or internal misuse. To an identity provider or database rule, a compromised account looks like a legitimate user sitting down at their desk.
When permissions attach strictly to the container—the repository, the folder, or the cloud tenant—any valid session unlocks everything inside it. The minute data leaves that container, access control vanishes. File-layer security shifts the boundary from the room to the document itself, requiring the file to evaluate identity and context every single time it’s opened, no matter where it lands.
How to Build Your Stack
Match the layer to where your data actually lives.
If your sensitive data is concentrated in Snowflake or Databricks, start at Layer 2. Immuta, Privacera, or Satori will do more for you than anything on this list.
If you run a large application estate with complex authorization rules, Layer 3 (Axiomatics or NextLabs) externalizes the decisions and keeps them consistent.
If you do not know who has access to what, Layer 4 comes first. Varonis or SailPoint File Access Manager will show you the sprawl, and Purview will label what you find if you are a Microsoft shop.
If sensitive files routinely leave your governed environment to contractors, outside counsel, advisors, partners, or AI tools, Layer 5 is the layer you are missing. It is also the only one that helps after the file has left.
Most enterprises end up with a Layer 1 tool they already own, plus one of layers 2 through 4, plus a file-layer tool. They are complementary. No layer above the file replaces the file layer, and the file layer does not replace the rest.
Seven Questions to Ask Any Vendor
- Where does enforcement stop? Ask for the exact boundary: the app, the tenant, the platform, the device.
- What happens to a file after it is downloaded or forwarded? Ask to see it, not hear about it.
- What can an attacker open with a stolen login? The answer should be specific to files, not "we detect anomalies."
- Can you revoke access to copies already shared? And how fast?
- Who holds the keys? If the vendor can decrypt your data, so can anyone who compels or compromises the vendor.
- How does it fit our identity provider, device management, and SIEM? Ask for the integration list and the rollout plan, phase by phase.
- What does a pilot prove, and how long does it take? Days, weeks, or quarters. A pilot that takes a quarter is a project.
🛡️ Map Your Own Stack in Two Weeks
In a two-week pilot, we map your active toolset against real-world file pathways to pinpoint exactly where your current access boundaries end. Requires zero migration and no disruption to daily workflows.
FAQs: Data Access Control for Enterprises
We already run Okta or Entra ID, and we have an access governance tool. What does a file-layer tool add that they don't?
Identity and governance tools decide who can reach a system and who holds permissions on it. They stop being able to enforce once a file leaves that system: downloaded to a laptop, attached to an email, synced to a personal drive, or pasted into an AI tool. A file-layer tool adds the one control that stays with the file. You keep everything you already own. In a pilot, we map each of your current tools against the path a real file takes and show you where control ends.
Will this change how our people work in SharePoint, Google Drive, and Dropbox?
No. Theodosian deploys over your existing stack without a migration, and users open files in the applications they already use. The difference only shows up when something is off: an unexpected device, an unusual location, a bulk download at 2 a.m. In those cases, access is denied, challenged, or frozen. Most of your users will never notice the layer is there.
What can an attacker open if they steal an employee's login?
With identity and permission tools alone, the attacker inherits everything that user could reach, and every check passes because the login is valid. With per-file protection, each file has its own key and policy, and opening it requires meeting that policy on identity, device, location, and time, not just holding a session. A stolen credential stops being a master key. If behavior looks abnormal, Drop the Gate freezes access automatically. Bring your own scenario to a demo, and we will walk through it with you.
Does this replace our DLP, Purview, or Varonis deployment?
No. They do different jobs. Varonis and Purview show you where sensitive data lives and who can reach it. DLP monitors channels. Theodosian protects the file itself wherever it goes. You keep what you have. If you want to see how the pieces fit, we can sketch the combined architecture for your stack on the first call.
Can we control which AI tools and agents open our files?
Yes. Theodosian brokers access for AI tools the same way it brokers access for people: each request is evaluated against the file's policy, and every request is logged. A file pasted into an unsanctioned tool does not lose its protection, because the protection lives in the file. If AI governance is on your roadmap this year, this is the question to put on the demo agenda.
Related Reading:
What Is Dynamic Access Control, and How Does It Go Beyond Role-Based Permissions?
What Stops an Attacker Who Has Valid Credentials from Accessing Your Files?
How to Revoke Access to a File After It's Already Been Downloaded or Shared