Why AI agent governance must start with enterprise data | Tech Radar

Overview

News, deals, reviews, guides and more on the newest computing gadgets

Start exploring exclusive deals, expert advice and more

Details

Unlock and manage exclusive Techradar member rewards.

Unlock instant access to exclusive member features.

Get full access to premium articles, exclusive features and a growing list of member rewards.

Why AI agent governance must start with enterprise data

When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.

Executives are spending a great deal of time asking whether AI agents are ready for production, but this is the wrong place to start, because agents aren’t acting in a vacuum. The quality of their decisions depends heavily on the quality of the data they use.

Model security and performance matter, of course, but they cannot compensate for weak control over the information the agent can retrieve. Before putting an agent into production, an organization needs governed inputs, appropriate access and a reliable record of what the agent produced.

Give an agent outdated customer information, duplicate records or material that was never properly classified, and it will work with what it has, making poorly informed decisions quickly across thousands of transactions.

Unfortunately, the gap between adoption and governance is widening fast. In the rush to adopt AI, many organizations are pushing agents into production before they have solved the underlying data problem, so it shouldn’t come as a surprise that the vast majority of AI projects show zero ROI.

What’s more, AI agent governance doesn’t end with the data an agent may access. It also encompasses the data an agent produces, such as its decisions, the instructions it was given and documents it created. As AI contributes to significant decisions within the enterprise, AI traceability and defensibility have become critical capabilities.

Why AI coding agents keep stalling before production and the governance controls that fix it

Most enterprise AI governance is already out of date

Organizations that build a strong data foundation put themselves in a stronger position to move from pilot to production with confidence that agents won’t transform poorly managed data into a company-wide crisis.

The data governance issue is not, of course, a new problem. Most large organizations have spent years trying to wrangle information spread across operational platforms, file shares, archives and applications that should have been retired long ago. But because agentic AI can rapidly act on those weaknesses at scale, the issue has become more pressing now.

Before an agent is given access to data, IT needs to identify sensitive and regulated information, apply classification and retention policies consistently, and determine which sources are current and reliable enough for the job. Legacy data deserves particular care.

Retired applications often contain valuable business history, but they also hold duplicate records, obsolete information and data that’s subject to legal holds or retention requirements.

Organizations should also preserve the context and relationships that give legacy data meaning, and then make selected, policy-controlled datasets available. AI does not act on data in a vacuum, and without the surrounding context, agents will either fail to complete their tasks or, worse, will make and act on faulty decisions.

Agentic AI adoption outpaces governance in regulated industries

Why financial institutions need a clearer approach to AI governance

Another mistake that enterprises make is to provide their agents with access to more data than they need. In fact, agents should also only have access to the data they require to complete the tasks they are assigned. Just because a system can be connected to an agent, that does not mean it should be.

Treat agents like employees, and follow the principle of least privilege. For example, while a customer service agent may need current account and transaction information, it most likely doesn’t need legal files or historic employee records. Access should narrowly follow the agent's defined purpose.

Provenance matters as well. An agent should not treat a current system of record and a decades-old archive as equally authoritative. Agents must know where information came from, when it was updated and which policies apply. Again, context matters. Without the proper context, agents will make costly mistakes.

Governance does not end once the agent receives approved data. AI-related data is rapidly becoming material to litigation, compliance reviews and customer complaints. To be prepared, an organization should be able to show what the agent was asked to do, which information it accessed, which policies were applied and what happened next.

Prompts, retrieved content, outputs and resulting decisions should be retained as business records. A reviewer should be able to reconstruct the AI’s decision and trace it back to both the source data and the person or function that authorized the activity.

Finally, accountability cannot belong to the technology team alone. Security, data, privacy, legal and compliance leaders all have a role, but a named business owner must remain responsible for the outcome. Automation can perform an action, but it cannot accept accountability for it.

Data readiness is not a secondary workstream to be addressed after an AI pilot succeeds. It is part of the decision to move that pilot into production. If an organization cannot trust the information, control access to it and clearly explain the resulting decisions, the agent is not ready for greater autonomy.

This article was produced as part of Tech Radar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of Tech Radar Pro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

You must confirm your public display name before commenting

The Eufy Omni E35 boasts huge suction power, good mopping performance, and self-cleaning

The EU will force data centers to disclose how much water and energy they are using

Vivo’s ultralight selfie screen could be the year’s standout mobile accessory

AI is wiping out whole degrees in China — translation, photography, illustration and fashion design are going, while prompt engineering is the new job appearing in film

These are Amazon's 16 best-selling tablets — and which ones are worth buying

Tech Radar is part of Future US Inc, an international media group and leading digital publisher. Visit our corporate site.

Key Takeaways

News, deals, reviews, guides and more on the newest computing gadgets
Start exploring exclusive deals, expert advice and more
Unlock and manage exclusive Techradar member rewards
Unlock instant access to exclusive member features
Get full access to premium articles, exclusive features and a growing list of member rewards