AI governance is rapidly becoming an extension of enterprise Data Management, not simply a new engineering or security discipline. In the Big Book of AI Governance, Databricks brings together how leading organizations are adopting principles to govern AI at enterprise scale, without slowing innovation. It presents a compelling vision of how enterprise AI can be governed at scale.
The implications extend well beyond Unity Catalog configuration and technical access controls. Investments in metadata, business glossaries, data quality, ownership and data governance operating models are increasingly relevant to AI adoption.
AI agents don’t just need access to data. They need to understand it, trust it and operate within boundaries defined by the business.
What’s new, and why should we pay attention?
The significant development goes beyond the platform functionality. It’s the changing role of governance from documenting and protecting assets to influencing how AI operates.
| From governing access to governing decisions | AI agents can interact with systems, invoke tools and execute activities. Governance must extend from static permissions to controls over agent behaviour. |
| From metadata for people to context for AI | Business definitions, relationships, semantic models and lineage are increasingly being positioned as machine-consumable enterprise context. |
| From isolated AI tooling to integrated governance | Databricks is bringing models, agents, MCP services, costs and observability into a more unified governance approach |
Three Data Management concepts that deserve attention
Context: Does AI understand the data it is using?
Business glossaries, semantic relationships, lineage, ownership, certification and data quality become essential ingredients for trustworthy agent behaviour. The opportunity is to turn enterprise metadata from something people search into something agents actively consume.
Kubrick’s view: Access to data does not guarantee understanding, and technically valid data is not necessarily fit for an AI use case.
Control: What is the agent permitted to do?
Identity, permissions, policy enforcement, approvals, monitoring and auditability need to operate across an agent’s interactions. The challenge for Data Governance teams: translating governance requirements into controls that can be enforced at runtime.
Kubrick’s view: A documented policy is not the same as an operational control. We need clear accountability for designing, implementing and monitoring those boundaries
Use Case Management: Why does the agent exist?
Each AI use case should have a defined purpose, accountable owner, risk classification, approved data dependencies and measurable outcomes. Use case governance connects the business objective to the context an agent needs and the controls that should apply.
Kubrick’s view: Organisations need to govern not only what AI can do, but why it should be doing it in the first place.
