The problem

Governance gaps are a business risk

Data has become one of the most critical assets in modern organisations. It underpins strategic decisions, customer experiences and AI-driven competitive advantage. Yet data is being collected and used at a pace that far outstrips organisations’ ability to govern it. Quality goes unmeasured, lineage remains undocumented, sensitive attributes are left untagged, and ownership is unclear. An AI model, in turn, is only as trustworthy as the data it was built on. 

While organisations respond with governance policies and data stewards, operationalisation remains the true gap. Resources are finite, governance is perceived as overhead, and the result is policies that exist on paper but are applied inconsistently in practice. 

The opportunity

Agentic governance at scale

Beyond a governance programme running in the background, the end goal is an organisation where data is managed as a strategic asset: every asset tied to measurable business value, every access decision traceable and every quality failure surfaced before it reaches a decision or regulator. 

Achieving this at scale is where agentic governance fundamentally changes the operating model. Rather than relying on data teams to manually profile datasets, trace lineage, investigate quality issues and document metadata in parallel and continuously, an agentic system performs the analysis and surfaces what requires attention. Teams can then focus on informed decision-making rather than time-intensive investigation. 

• Cost and risk reduction. Issues that previously surfaced in reports or escalation letters are caught at the pipeline level, before they reach a decision. Periodic audits are replaced by a continuously updated view of what is ungoverned and where the exposure lies 
• Trusted AI outputs and data ROI. An AI model is only as defensible as the data it was trained on. When training data is governed, profiled and attested before a model approaches a decision, the organisation can stand behind its outputs to the business and customers 
• Regulatory compliance. When an auditor asks for evidence of GDPR compliance, the answer is ready. It is not assembled over three weeks, but maintained continuously as data assets are mapped to their obligations in real time 
• Operational efficiency. A governance team can maintain continuous oversight across a data landscape that would previously require significantly more resources. Investigation, detection and prioritisation shift to the agent; governance and stewardship teams are elevated to strategic decision-makers 

How it works

Agentic governance on Databricks

The following describes how the agent delivers those outcomes in practice. The solution is built on two native Databricks capabilities: 1) Unity Catalog, which maintains a complete record of data assets, schemas, lineage, access history, quality metrics, tags and ownership across the lakehouse, and 2) an agentic AI layer that reasons over data contracts, classification policies, regulatory requirements and other supporting governance documentation. Together, they generate remediation plans and orchestrate actions across the platform and connected systems. 

In practice, the agent operates across five interconnected activities:

• Detect. The agent continuously analyses Unity Catalog’s system tables and metadata to surface issues across the full data management landscape, including quality, lineage, metadata completeness, sensitivity tagging, access rights and usage patterns 
• Diagnose. Findings are assessed in business terms, prioritised by potential impact, distinguished from noise and framed in language meaningful to both technical and business stakeholders 
• Remediate. The agent generates specific, actionable remediation proposals for data quality rules, lineage annotations, tag assignments and access changes. Each requires human approval before execution 
• Report. The agent provides data officers, stewards and auditors with a view of governance posture across all dimensions: quality scores, lineage coverage, metadata completeness, sensitivity tagging and access hygiene 
• Assess. The agent regularly benchmarks data management practices against an industry-recognised data management maturity framework, identifies which gaps are limiting progress and recommends specific actions tied to assets and owners in Unity Catalog. Maturity advancement becomes a continuously driven programme rather than a periodic assessment 

The approach

Anchoring governance in the business

Agentic governance accelerates and sustains a governance model, but it is most effective when paired with organisational commitment to act on what it surfaces. In practice, many organisations start with a limited governance foundation: no formal ownership, no defined domains, no established standards, and difficulty enforcing them consistently across the organisation. Addressing that, alongside the technical implementation, is as important as the implementation itself. 

A practical approach is to start with one or two high-visibility domains, identified either through business priority or surfaced by the agent through usage patterns, downstream dependencies and quality signals across the data platform. The focus should be on data that feeds the decisions that matter most to the organisation. The agent scans those domains, surfaces where quality fails, lineage breaks and sensitive data is ungoverned and produces a ranked view of what needs attention. This output drives the ownership conversation. When a business stakeholder sees concrete evidence that a dataset feeding their process is ungoverned, accountability becomes a business decision rather than a governance exercise. 

Data contracts, quality rules and classification policies follow. Governance then expands domain by domain. At each stage, the agent signals when a domain is ready to progress and where the highest-impact gap now lies. This keeps the programme moving without the need for a separate steering process to decide what comes next. 

The shift

From operational effort to strategic oversight

As the agentic governance model takes hold, the impact extends beyond process and technology. It changes what every governance role is asked to do. The roles defined in the DAMA Data Management Body of Knowledge form the backbone of operationalisation. What changes is the nature of the work and not the structure of the work. 

Each role shifts from execution to oversight, from reactive to proactive. As governance matures, some roles naturally consolidate while others evolve significantly. The agent does not eliminate the need for human judgment, but it does change how many people are needed to exercise it. 

	Today	With agentic governance
Data owner	Accountable for asset quality and access; responds to requests individually with limited visibility into whether existing rights remain appropriate over time.	Presented with a prioritised view of quality findings, stale access rights, and policy deviations, each assessed against data contracts and classification policies, with specific remediation actions ready for approval.
Data steward	Responsible for tags, lineage, and metadata across a growing landscape; contract violations and schema drift typically surface only after downstream impact has occurred.	Presented with agent-generated tag assignments, lineage updates, and metadata corrections for review; data contract breaches and schema drift are flagged continuously before they reach production.
Governance manager	Defines policies and standards; relies on periodic check-ins and self-reporting to assess whether they are applied consistently across the organisation.	Policy adherence is monitored continuously against defined data contracts; the agent identifies maturity gaps, recommends the specific actions needed to advance, and tracks progress, turning governance advancement into a managed, evidence-driven programme.
Compliance officer	Tracks adherence to GDPR, HIPAA, and EU AI Act requirements through periodic reviews; audits evidence compiled across fragmented systems, often under time pressure.	Each data asset and lineage path is continuously mapped to its regulatory obligations: GDPR residency and consent, HIPAA handling controls, EU AI Act training data requirements, with gaps flagged and audit-ready evidence always maintained.
Chief data officer	Governance health is assessed through point-in-time reports; tracking progress and making the case for governance investment remains a significant effort.	A continuously updated maturity view across all DAMA knowledge areas, with the agent actively surfacing what needs to change and when, providing the evidence base for governance investment decisions and a measurable trajectory the business can report on.