For years, data governance was something that happened around data: committees approved definitions, stewards maintained glossaries, and policies lived in documents that few engineers read. The arrival of AI agents breaks that model from two directions at once. On one side, agents are becoming the most demanding data consumers an organization has ever had: they query at machine speed, combine sources freely and act on what they find. On the other side, agents are starting to do governance work themselves, classifying data, drafting definitions, triaging quality issues and proposing fixes. Governance that depends on manual review and static documentation cannot keep up with either.
This article explains what “agentic data governance” means in practice: governing data for agents and governing data with agents. It covers the role of active metadata, how to turn policies into enforceable code, how to keep agents inside permission boundaries, and a staged roadmap with a realistic example.
Why Passive Governance Fails in the Agent Era
Gartner put the problem plainly in February 2025. In a release on AI-ready data, it reported that 63% of organizations either lack the right data management practices for AI or are unsure whether they have them, and predicted that through 2026 organizations will abandon 60% of AI projects not supported by AI-ready data. Two of its recommendations are central to governance: work with legal and business leaders to set AI data governance rules, including automatic detection and protection of sensitive data, and make metadata active rather than passive so it supports automation. Gartner also warned that basic or manual metadata management will hinder AI readiness.
Passive governance fails agents in specific ways:
- Policies are not machine-readable. An agent cannot read a PDF policy and reliably decide whether a column may be used for a marketing action.
- Metadata is stale. Catalog entries written once and never updated tell an agent that a table is certified when its upstream source changed last month.
- Access is too coarse. Service accounts with broad read access give agents more than any individual user would be allowed to see.
- Review does not scale. If every new dataset, definition or quality rule waits for a committee, agents and the teams building them route around governance entirely.
What Active Metadata Means
Active metadata is metadata that is continuously collected, kept current and used to drive automated actions, rather than written once for humans to read. In practice it combines several streams:
- Technical metadata: schemas, lineage, freshness and query logs harvested automatically from platforms.
- Operational metadata: data quality results, incidents, observability signals and usage patterns.
- Business metadata: glossary terms, owners, certification status and data product contracts.
- Policy metadata: classifications such as personal data, confidential or export-controlled, plus the rules that apply to each class.
The point is not to collect more metadata, but to connect it to decisions. When a column is classified as personal data, masking should apply automatically wherever it flows. When a dataset fails its quality checks, its certification badge should drop and agents should see the change. When a new table appears that resembles an existing sensitive one, it should be flagged for classification. That is what turns a catalog into a control plane.
Where Active Metadata Lives
Most organizations already have the raw ingredients scattered across tools: lakehouse and warehouse catalogs hold schemas and permissions, orchestration tools hold run history, observability tools hold health signals, and business glossaries live in a governance platform or a wiki. Active metadata does not require replacing all of these with a single product. It requires a metadata backbone that synchronizes the critical attributes, such as owner, classification, certification, freshness and lineage, and makes them queryable by both humans and machines through APIs or MCP endpoints. A good test is simple: can an agent, at runtime, ask “is this dataset certified, fresh and allowed for this purpose?” and get an authoritative answer in milliseconds? If not, the metadata is still passive.
In the agent era, governance that lives in documents is governance that does not exist. Policies have to be machine-readable, metadata has to be current, and every agent has to inherit the permissions of the person it acts for.
Governing Data for Agents: Five Controls
1. Permission Inheritance
An agent acting for a user should see only what that user can see. IBM’s description of its MDM MCP server makes this explicit: the server enforces the same authorizations and access restrictions as the MDM API, so an agent acting for a user is limited to that user’s view, and restricted fields such as tax IDs are hidden. Apply the same principle to every data access path agents use, including warehouses, semantic layers, document stores and APIs. Avoid shared, highly privileged service accounts for agents.
2. Scoped, Intention-Revealing Tools
Expose data to agents through specific tools such as “get customer profile” or “query certified sales metrics” rather than open-ended query access. Narrow tools make policy enforcement and auditing much simpler, and they keep agents on curated, governed data products.
3. Fitness-for-Use Signals
Agents should be able to check whether data is fit for the action they are about to take: certification status, quality scores, freshness and known incidents. Actian’s 2026 paper on agent readiness argues that if an AI system cannot verify data health at the moment of action, it is not ready for autonomous decisions, and suggests exposing health status to assistants through an MCP server.
4. Purpose and Usage Policies as Code
Encode rules such as “consent-based marketing attributes may be used only for customers with active consent” or “EU personal data may not be sent to models hosted outside approved regions” as policies evaluated at query or tool-call time, using the classification metadata. Policy-as-code makes rules testable, versioned and consistently enforced.
5. Logging and Traceability
Record which agent, acting for which user, accessed which data through which tool, and what it did next. This is essential for incident investigation and increasingly expected by auditors and regulators assessing automated decision-making.
Governing Data with Agents: Supervised Stewardship
The second half of agentic governance is using agents to do governance work. The most promising tasks are those where agents propose and humans decide:
- Classification: suggesting sensitivity labels and glossary terms for new columns based on names, sample values and similar assets.
- Documentation: drafting dataset descriptions and definitions from lineage, code and usage, for owners to approve.
- Quality rule drafting: proposing validation rules from profiles and documentation.
- Issue triage: grouping alerts, tracing root causes through lineage and routing to owners.
- Stewardship tasks: triaging match proposals in MDM and resolving clear cases.
Vendors already ship this pattern. Ataccama describes agents that triage MDM match proposals, explain why records were proposed as matches and create tasks with their reasoning attached, operating under the same roles and permissions as the standard interface, with agent work kept as drafts, routed to an approver or published depending on risk. The article recommends that riskier actions and permanent data changes require human approval, and frames stewards as supervisors of agents rather than reviewers of every record. That is a useful model for governance work generally.
A Staged Roadmap
Stage 1: Make Metadata Active (Months 0–3)
- Automate harvesting of schemas, lineage, freshness and usage from your main platforms into the catalog.
- Connect data quality and observability results to catalog entries so certification reflects current health.
- Define a small, clear classification scheme (for example public, internal, confidential, personal, special category) and apply it to critical data products first.
- Assign owners for every certified data product, recorded in metadata, not a spreadsheet.
Stage 2: Enforce Policies for Agent Access (Months 3–6)
- Inventory existing and planned agents, the data they touch and the identities they use.
- Replace broad service accounts with user-delegated access or narrowly scoped identities.
- Implement masking and row-level policies driven by classification, and test them through agent tool paths.
- Expose fitness-for-use signals and require high-impact agents to check them before acting.
- Turn on logging of agent data access with user, tool and purpose.
Stage 3: Introduce Governance Agents (Months 6–12)
- Start with classification and documentation suggestions, measured by owner acceptance rates.
- Add triage agents for quality incidents with read-only access.
- Allow supervised write actions for narrow, reversible stewardship tasks, with approval workflows and audit trails.
- Review autonomy boundaries quarterly against reversal rates and incidents.
Worked Example: An Insurer Rolling Out Claims Agents
Consider an insurer deploying agents that help claims handlers summarize files, check policy coverage and draft customer letters. The first prototype used a service account with read access to the entire claims warehouse and document store. Governance review halted it: the agent could see medical details for claims the handler was not assigned to, and nobody could say which datasets were current.
The governance team took a staged approach. Lineage and freshness were harvested automatically into the catalog, and quality checks on the core claims and policy tables were linked to their certification status. Columns and document types containing health information were classified as special category data, and masking policies were tied to those classifications. The agent was rebuilt to use delegated access, so it inherited each handler’s permissions, and it accessed data only through three tools: “get claim summary,” “get policy coverage” and “search claim documents,” each enforcing row-level rules by assignment. Before drafting a letter, the agent checks the certification status of the policy data; if the dataset is flagged with an open incident, it tells the handler and does not draft coverage statements.
Six months in, the team added a classification agent that scans new document types and columns as they appear and proposes labels, which data owners approve or correct. Owner corrections feed back into the agent’s instructions. Every agent action is logged with handler, tool and purpose, giving compliance a clear trail for audits of automated processes.
What made the difference was not a new governance platform but the wiring between existing pieces. The catalog already existed; it simply had not been connected to quality results or to the agent’s access path. The classification scheme already existed on paper; it had not been turned into masking policies. Once metadata was active and policies were enforced at the tool layer, the same agent that had been blocked could be approved, and subsequent agents reused the same tools and controls rather than starting from scratch.
Common Pitfalls
- Governing agents as if they were users with logins. Agents need identities, but they act on behalf of people. Without delegation, you either over-privilege the agent or block it.
- Over-engineering the classification scheme. Twenty sensitivity levels look rigorous and are applied inconsistently. Start with a handful that map directly to enforceable policies.
- Letting governance agents publish directly. Agent-drafted definitions and classifications are valuable suggestions, but an owner should approve them until acceptance rates prove they are reliable.
- Treating the catalog as the goal. A beautiful catalog that does not drive masking, certification or agent checks is still passive governance.
- Ignoring unstructured content. Documents, emails and transcripts feed many agents. Classification and access policies must cover them, not just tables.
Measuring Agentic Governance
Choose a few indicators that show whether governance is actually running as a system rather than a set of documents, and report them alongside agent adoption metrics so leadership sees governance as an enabler of AI rather than a brake on it. Good starting points are below. Track them per domain, because maturity usually varies widely between, say, finance data and marketing data, and the gaps tell you where the next agent rollout is likely to stall. Revisit the list every quarter as agents take on more responsibility; indicators that matter in the first year, such as classification coverage, give way to ones about autonomy, such as reversal rates and policy violations prevented at runtime.
- Share of critical data products with current owners, classifications and certification linked to live quality signals.
- Share of agents using delegated or narrowly scoped identities rather than broad service accounts.
- Policy violations caught at tool-call time versus discovered afterward.
- Acceptance and reversal rates for agent-proposed classifications, definitions and stewardship actions.
- Time from new dataset creation to classification and ownership assignment.
Conclusion
Agentic data governance is not a new committee or a new tool category. It is the practical consequence of two facts: agents need governed data delivered in a machine-enforceable way, and governance teams cannot scale without agents helping them. The path forward is to make metadata active, translate policies into code that runs at the moment of access, ensure every agent inherits the permissions of the person it serves, expose fitness-for-use signals, and introduce governance agents that propose while humans decide. Gartner’s advice to treat AI readiness as an ongoing practice applies doubly here: governance becomes a running system, not a document set.
How Hanoi Technology Can Help
Hanoi Technology helps organizations build agent-ready governance, from active metadata and classification to policy-as-code, delegated access for AI agents and supervised stewardship workflows.