Open semantic interchange changes how data governance scales

At a glance

What this is: This is a governance analysis of Open Semantic Interchange with Snowflake and Collibra, arguing that consistent semantic context, access policy translation, and lineage are now needed to scale trusted data delivery and AI use.

Why it matters: It matters because IAM, governance, and data security teams increasingly need controls that follow data into semantic layers, model workflows, and AI consumption paths instead of living only in upstream systems.

Context

Open Semantic Interchange is a way to carry shared business meaning, metric logic, and governance context across platforms instead of recreating it in each tool. In this article, Collibra frames that problem through the gap between raw data delivery and trusted business consumption, especially when AI models depend on the same definitions as dashboards.

The governance gap is not just inconsistent reporting. It is the lack of a common semantic layer that can enforce policy, preserve lineage, and keep human users and AI systems aligned on what data means. That is the identity-adjacent control problem this post addresses: who can consume which data, under what meaning, and with what policy context attached.

Key questions

Q: How should teams govern semantic layers for agentic AI systems?

A: Teams should govern semantic layers as authoritative decision infrastructure, not as a reporting convenience. That means standardising core business definitions, tracing AI outputs back to those definitions, and refusing autonomous execution when context is fragmented. The goal is consistent machine interpretation across tools, workflows, and identity types.

Q: Why do inconsistent semantics create risk for IAM and AI governance?

A: Inconsistent semantics cause different systems to make decisions from different interpretations of the same term. That breaks trust in access approvals, exception handling, and AI outputs because the control logic depends on the meaning of the data, not just the data itself. Governance must therefore cover definitions as well as systems.

Q: What breaks when access policy and semantic meaning are managed separately?

A: Policy may still block or mask data correctly, but the organisation can end up authorising the wrong business meaning. Users may see the right rows with the wrong interpretation, which creates trust failures that are hard to detect because the control is technically working while the decision is still wrong.

Q: How do organisations know whether semantic governance is actually working?

A: Semantic governance is working when critical definitions are consistent across tools, changes are approved, and lineage can explain how a decision was derived. If users still argue about what a metric means, or if AI outputs vary because upstream terms drift, the governance layer is not effective.

Technical breakdown

Why semantic layers matter for governed data consumption

A semantic layer translates raw tables into business terms such as metrics, dimensions, and formulas. Without that layer, the same KPI can be calculated differently across dashboards, pipelines, and AI applications, which creates inconsistent decisions and weakens governance. Collibra's argument is that the semantic definition must be portable, not trapped inside one application or catalog. That matters because governance fails when meaning is reconstructed downstream instead of inherited upstream. Practical implication: treat semantic definitions as governed assets that must be versioned, shared, and enforced across every consumption path.

Practical implication: govern semantic definitions as first-class assets and require consistent reuse across analytics and AI.

How access governance maps to Snowflake policies

The article describes policy translation from plain language into native Snowflake controls such as row access policies and dynamic data masking. That is important because governance only scales when intent becomes enforceable policy at the point of query or consumption. In practice, this reduces the gap between business policy and technical enforcement, especially for mixed datasets containing sensitive and non-sensitive fields. The control challenge is not just who has access, but how much of the record or metric they are allowed to see. Practical implication: align policy intent with native platform enforcement so masking and access decisions happen where the data is actually used.

Practical implication: convert business policy into platform-native enforcement so data is filtered or masked at consumption time.

Why AI governance depends on verified facts and lineage

The post ties AI governance to lineage, verified facts, and semantic consistency for models built in Snowpark and consumed through AI assistants. That is the right framing because model output quality depends on the provenance and meaning of the inputs, not just on model performance. If the training tables, metrics, or dimensions are ambiguous, the model can produce plausible but unreliable answers. Governance therefore has to cover the semantic path from source data to model to user-facing answer. Practical implication: require lineage and semantic provenance for the facts feeding AI systems, not only for the datasets they store.

Practical implication: govern the semantic inputs to AI models with the same discipline you use for data provenance and lineage.

Threat narrative

Attacker objective: The objective is not a classic compromise but the erosion of trustworthy data consumption through inconsistent meaning, policy drift, and unreliable AI context.

1. Entry occurs when business users or AI systems consume data through inconsistent semantic definitions, creating a trust gap before any control is enforced.
2. Escalation happens when the same metric or policy is interpreted differently across dashboards, models, and workflows, allowing inconsistent answers to spread.
3. Impact is loss of confidence in analytics and AI outputs, plus higher risk that sensitive data is exposed or misused under unclear policy context.

Breaches seen in the wild

• Snowflake breach: Snowflake breach compromised Ticketmaster, Santander and others via cloud credential abuse.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Open semantic interchange turns governance from a static control layer into a portable trust layer. The important change is not simply that definitions are shared across tools, but that governance context can move with data as it is consumed by humans and AI systems. That shifts the burden from reconciling outputs after the fact to enforcing meaning before consumption. Practitioners should read OSI as a governance portability problem, not a formatting exercise.

Semantic consistency is now an access control problem, not just a reporting problem. When a metric definition changes between the source system, the BI layer, and the AI layer, the organisation is not only creating bad analytics. It is also creating inconsistent entitlement semantics, because users and systems may be authorised to see different versions of the truth without realising it. That is why semantic governance and access governance need to be designed together.

Governed semantic layers are becoming the control plane for AI trust. AI applications do not become reliable simply because they can reach more data. They become reliable when the data they reach is classified, lineage-backed, and semantically stable enough to support reproducible answers. Without that, the organisation is accelerating model output while degrading decision confidence. Practitioners should expect semantic governance to become a prerequisite for safe AI scaling.

Open standards are changing the shape of governance ownership. If semantics can move across platforms, then governance can no longer be treated as a point solution attached to one warehouse or catalog. The market is moving toward shared control of meaning, policy, and lineage across data engineering, governance, and AI teams. That makes operating model clarity more important than tool consolidation.

Recipe transparency is the right named concept for this shift. Business users and AI systems are not only asking for data access. They are asking to see the logic, ingredients, and lineage behind the answer. In practice, this is the difference between opening a dataset and opening the governance story behind it, and that story now has to be consistent across every consumer.

What this signals

Recipe transparency is becoming the practical test of data governance maturity. If teams cannot show how a metric is derived, which source facts it uses, and what policy context travels with it, they do not have portable governance. That becomes more visible as AI agents and business users draw from the same semantic layer.

When governance is attached only to the source system, it breaks as soon as data is copied, modelled, or reinterpreted elsewhere. The operational task now is to make semantic definitions, access policy, and lineage travel together so the control survives each consumption step.

For practitioners

• Define semantic assets as governed objects Inventory the metrics, dimensions, formulas, and business terms that must stay consistent across BI, warehouse, and AI workflows.
• Translate policy into native controls Map plain-language access rules to row-level filtering and dynamic masking so governance is enforced where users and agents query data.
• Require lineage for AI inputs Track which training tables, facts, and semantic definitions feed each model so the organisation can trace why an answer was produced.
• Unify definitions across dashboards and models Establish a single approved metric definition for high-value business terms so the same calculation is reused everywhere it appears.
• Treat unstructured data as governed input Classify documents, PDFs, and images before they enter AI workflows so sensitive content is not consumed without context.

Key takeaways

• Open semantic interchange is really about moving trusted meaning with the data, not just moving data between systems.
• The main governance risk is that the same metric, policy, or lineage story can diverge across dashboards, models, and platforms.
• Practitioners should treat semantic definitions, access controls, and AI provenance as one governance problem rather than three separate ones.

Key terms

• Open Semantic Interchange: Open Semantic Interchange is a vendor-neutral standard for representing governed business meaning across systems. It allows semantic models to move between platforms without losing the definitions that keep metrics, measures, and data objects consistent. For AI and analytics teams, it reduces ambiguity when sharing trusted context across tools.
• Action Layer: The action layer is the point where an identity moves from asking for access to doing something with that access. For AI agents, this layer matters because tool use can happen faster than human review, and the meaningful risk appears when actions are chained across systems.
• Data Lineage: The record of how data moves across systems, applications, and workflows. In security operations, lineage shows where sensitive data propagates, which identities touch it, and how a compromise could spread across connected environments.
• Dynamic Data Masking: Dynamic data masking is a runtime control that hides sensitive values in query results without changing the source data. It is commonly used to restrict live access in production systems, but it does not create a portable dataset and depends on the query path for enforcement.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity and security programme, it is worth exploring.