Collibra’s governance thesis: AI agents are driving consolidation

At a glance

What this is: Collibra frames AI agents as a catalyst for governance consolidation because fragmented data tooling and siloed control planes no longer match how modern platforms move, combine, and govern data.

Why it matters: IAM, NHI, and AI governance teams should read this as a warning that policy, lineage, and trust boundaries will fail if they stay attached to isolated platforms rather than the semantic and governance layer.

Context

The article argues that the data and AI stack is being reshaped by decoupled storage and compute, open table formats, zero-copy movement, and AI systems that consume both structured and unstructured data. In practical terms, the governance problem is no longer limited to a single platform or data type, because control, context, and trust now have to follow workloads across multiple execution environments.

For identity practitioners, the central issue is not data architecture alone. It is the governance burden created when autonomous applications and AI agents rely on context spread across platforms, while the controls that approve, classify, and monitor access remain fragmented and uneven in maturity.

Key questions

Q: How should security teams govern AI agents that reason across multiple data platforms?

A: Security teams should govern the meaning layer, not just the access layer. That means defining shared business terms, lineage, and quality signals centrally, then making sure agents retrieve that context at runtime across every platform they touch. Without that control, the same agent can reach different conclusions from the same data.

Q: Why does fragmented governance create more risk as AI adoption grows?

A: AI increases the speed and reach of data usage, so any inconsistency in policy or access control is amplified across more workflows, more users and more decisions. Fragmentation also makes remediation slower because no one control plane can explain the full path of the data. The result is policy drift and trust erosion.

Q: What breaks when unstructured data is not classified and controlled?

A: When unstructured data is not classified and controlled, organisations lose track of what content exists, where it resides, and who can use it. That leads to data silos, inconsistent access, unmanaged sharing, and unclear accountability across teams. In practice, security and privacy controls become uneven, retention becomes unreliable, and sensitive information can move into AI workflows without the oversight needed to protect it.

Q: What is the difference between platform-native governance and a decoupled governance layer?

A: Platform-native governance is tied to one product's control model, while a decoupled layer preserves policy, lineage, and context across multiple platforms. That difference matters when data, compute, and AI usage move independently, because the enterprise still needs one coherent view of trust and control.

Technical breakdown

Why decoupled storage and compute change governance boundaries

Open table formats let data workloads run where the data already lives, which reduces the need for bulk movement and weakens the old assumption that governance can sit inside a single warehouse or pipeline. As compute shifts toward the application or agent consuming the data, policy has to remain consistent across platforms that may expose different lineage, access, and monitoring capabilities. The architectural shift is not just cost-related. It changes where authoritative control is enforced and where trust must be established.

Practical implication: Treat governance as a cross-platform control layer rather than a property of any one storage or compute stack.

Why unstructured data creates a new access and trust problem

AI applications and AI agents increasingly combine structured and unstructured data, but the governance model for unstructured content is still immature. Unlike tidy relational records, unstructured data requires discovery, classification, curation, access control, quality checks, and monitoring at scale, often across repositories with different semantics and lifecycle rules. That means the old structured-data governance pattern does not translate cleanly. The control challenge is not just volume. It is that business meaning is harder to codify, which makes trust decisions less deterministic.

Practical implication: Map unstructured-data governance to explicit ownership, classification, and access rules before it is consumed by AI systems.

How governance fragmentation becomes the operational failure mode

When each platform ships its own governance features, the enterprise gets overlapping policy models, inconsistent lineage, and uneven enforcement quality. That fragmentation resembles the data-silo problem from earlier stack generations, except the failure now sits at the governance layer itself. If an organisation cannot compare, compose, or centralise policy across environments, it will struggle to prove quality, security, privacy, and auditability at production scale. Open standards such as OpenLineage and Open Data Contracts matter because they reduce the probability that governance itself becomes vendor-bound and fragmented.

Practical implication: Standardise metadata and control semantics so governance can be enforced consistently across platforms and use cases.

NHI Mgmt Group analysis

Governance fragmentation is becoming the new control-plane risk. The article is right to treat governance silos as the next failure pattern after data silos. When each platform exposes its own policy model, identity context, lineage view, and access workflow, practitioners lose the ability to reason about control uniformly. The result is not just inefficiency. It is an inability to prove which governance rule actually governs a dataset or workload at the moment it is used. Practitioners should expect control inconsistency to become a primary operational risk across data and AI estates.

The semantic layer is becoming the governance boundary that matters most. AI systems need business context, not just storage access, so the semantic layer becomes the place where meaning, permission, and trust converge. That makes governance more than classification and more than lineage. It becomes the executable bridge between data architecture and consumption-time decisions. For practitioners, this means the governance programme must follow context wherever workloads move, especially when AI agents assemble answers from multiple sources.

AI agents amplify the cost of fragmented governance because they consume context continuously. Human users can sometimes tolerate inconsistent controls by working around them. Agents cannot. They operationalise whatever context and permissions they are given, which means fragmented governance turns quickly into brittle production behaviour. This is where the governance lesson broadens beyond analytics platforms: as autonomous consumers of data scale, the enterprise needs a control model that remains coherent across tools, workflows, and repositories.

Open standards are emerging as a governance preservation strategy. OpenLineage and Open Data Contracts are relevant here because they make governance easier to move with the workload instead of re-creating it inside every platform. That does not eliminate the need for strong internal ownership, but it reduces lock-in at the control layer and makes scale more realistic. The practitioner takeaway is straightforward: if governance cannot travel, it will fragment, and fragmented governance will not survive multi-platform AI adoption.

What this signals

Governance has become the differentiator that determines whether AI adoption remains controllable. As more workloads move across platforms, teams will need control semantics that survive decoupling, not just point-tool features that work inside one stack. The practical signal is that policy portability is now a programme requirement, not an architecture preference.

AI governance will increasingly depend on whether context can move with the workload. When the semantic layer carries business meaning and executable rules, it becomes possible to scale AI without multiplying control silos. Teams that cannot express context in a portable way will keep re-litigating the same access and trust decisions in every platform.

Open standards will matter more as the stack fragments. Standards such as OpenLineage and Open Data Contracts give practitioners a path to preserve lineage and contractual meaning across systems. The programme implication is to prioritise control interoperability now, before governance becomes harder to consolidate later.

For practitioners

• Define a unified governance control plane Establish one policy model for classification, access, lineage, and quality that can be applied consistently across data and AI platforms, rather than relying on each platform's native controls.
• Codify business context in the semantic layer Translate critical business definitions, trust rules, and data product ownership into executable semantics so AI consumers do not infer meaning from isolated datasets.
• Inventory unstructured-data governance gaps Identify where unstructured repositories lack classification, monitoring, or access ownership, then close the highest-risk exposures before they are fed into AI workflows.
• Adopt open metadata standards for portability Use standards such as OpenLineage and Open Data Contracts to keep lineage and policy signals portable as workloads move across platforms.

Key takeaways

• AI agents are accelerating a shift from platform-bound controls to cross-platform governance, and fragmented policy models are becoming a structural weakness.
• The article's main warning is that the next control failure will be governance fragmentation, not just data fragmentation.
• Practitioners should prioritise portable policy, semantic context, and open metadata standards so governance survives multi-platform AI usage.

Key terms

• Action Layer: The action layer is the point where an identity moves from asking for access to doing something with that access. For AI agents, this layer matters because tool use can happen faster than human review, and the meaningful risk appears when actions are chained across systems.
• Fragmented Governance: Fragmented governance is a state where policy, access control, lineage and accountability are split across separate tools or teams. The result is inconsistent enforcement and weak traceability, especially in AI programmes where data moves quickly across domains and identities.
• Open Data Contract: An open data contract is a shared, machine-readable agreement about what data means, how it should be used, and what quality or access conditions apply. It makes governance more portable across systems by defining expectations outside any single platform implementation.
• Decoupled Governance: Decoupled governance is a model where control, policy, and lineage are managed separately from compute or storage infrastructure. This allows governance to follow data and AI workloads across platforms instead of being trapped inside one vendor's execution stack.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or governance programme, it is worth exploring.