Should organisations prioritise data governance or agent controls first?

They have to do both, but data governance usually exposes the fastest risk because agents inherit whatever permission state and content quality already exist. If the underlying repositories are messy or overshared, adding more agent controls will not restore trust in the workflow.

Why data governance usually comes first

Data governance is the faster lever because it shapes what agents can see, reuse, and act on. If content is duplicated, stale, overshared, or missing ownership, agent controls only limit the blast radius of a broken data estate. A practical first step is to fix the permission model and the data quality rules that determine whether an agent can be trusted at all.

That usually means treating classification, ownership, retention, and access boundaries as prerequisites, not afterthoughts. The Data Governance and Data Catalogue Security Guide is the right starting point when the main problem is catalogue drift, unclear ownership, or inconsistent access labels across repositories.

What agent controls should cover after the data layer is stable

Agent controls matter because agents amplify whatever access they inherit. Once the data layer is governed, the next question is not whether an agent exists, but whether it can authenticate cleanly, request only the access it needs, and stay within a bounded execution context. That is where task-scoped privilege, delegated authority, and per-action policy checks become essential.

For AI systems that act on behalf of users or orchestrate tools, the control stack should separate identity, authorization, and observability. The AI Agent Authorisation Guide helps when the key question is how to stop an agent from carrying standing privilege into every workflow. If the agent communicates across systems or agents, the Multi-Agent and A2A Security Guide is the better fit because delegation and trust boundaries become part of the control problem.

How to decide the order in practice

Prioritise data governance first when the environment has weak ownership, messy taxonomy, broad access, or poor confidence in source data. Prioritise agent controls first only when the data estate is already reasonably governed and the immediate risk is agent misuse, overreach, or uncontrolled delegation. In most organisations, the first material exposure is not the agent itself, but the inherited access pattern it is allowed to use.

A useful decision rule is simple: if the workflow would still be unsafe with no agent present, fix the data governance issue first; if the workflow is safe for humans but becomes unsafe only when automated, focus on agent controls first. When the work involves browsers, sessions, or shared interactive access, the Browser and Computer-Use Agent Security Guide is especially relevant because session reuse and scoped interaction are often the real failure point.

Risk and Threat Considerations

When organisations reverse the sequence, they often add controls around a workflow that is already over-permissioned or poorly understood. That leaves a large latent exposure: the agent may faithfully execute bad data decisions, leak sensitive content, or propagate stale permissions faster than a human process would.

Failure mechanism: Overshared repositories, weak classification, and unclear ownership give the agent a wider and less reliable action surface. Even well-designed agent controls cannot restore trust if the underlying data permissions and content hygiene remain broken.

Impact: The result is greater chance of inappropriate disclosure, incorrect decision-making, and wider blast radius when an agent is compromised or simply behaves as designed against bad inputs. The control gap becomes systemic rather than local.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Agentic AI Top 10 addresses the attack and risk surface, while CSA Cloud Controls Matrix and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CSA Cloud Controls Matrix	IAM — Identity and Access Management	Agents depend on governed access to data and systems.
Recommendation — Apply IAM controls to bound agent access to approved data and actions.
NIST SP 800-53 Rev 5	AC-6 — Least Privilege	The question turns on limiting what agents can do with inherited access.
	AU-2 — Event Logging	Agent workflows need traceability when access and data quality are in question.
Recommendation — Enforce least privilege for any agent that can reach sensitive repositories. Log agent actions that read, transform, or move governed data.
OWASP Agentic AI Top 10	ASI03 — Identity & Privilege Abuse	Agent overreach is a core failure mode when permissions are inherited.
	ASI02 — Tool Misuse	Agent controls must constrain how tools are used against governed data.
Recommendation — Restrict delegated authority and review privileged agent actions. Validate tool use against policy before allowing high-impact actions.

Practitioner Guidance

What to prioritise: Start by identifying the highest-risk data sets, not the most visible agent. Fix ownership, access scope, and content quality for the repositories the agent will touch before expanding automation.

What to verify: Confirm that the agent can only reach data it genuinely needs, and that the data it can reach is classified, owned, and current. If you cannot explain why a dataset is reachable, the control design is not ready.

Common mistake: Teams often pilot an agent on top of a messy data estate and then expect guardrails to compensate for inherited permissions. That usually creates more confidence than control.

Practitioner takeaway: The first control decision is about reducing inherited risk, not adding another layer of automation. If the data layer is ungoverned, agent controls will only make the existing problem faster and harder to unwind.