Smart data delivery now hinges on governance built into infrastructure

At a glance

What this is: This is Raidiam’s reflections on the Smart Data Forum 2026, arguing that smart data is now an infrastructure delivery problem rather than a policy experiment.

Why it matters: It matters because IAM, consent, and governance teams now need to design identity and access controls that scale across sectors, data-sharing models, and agentic AI use cases.

By the numbers:

• 1.3 million people paid their self-assessment tax bills via open banking in January 2026.
• The government target is at least five active smart data schemes by 2030 and 20 or more by 2035.

Context

Smart data now depends on infrastructure that can carry consent, identity, and data-sharing governance at scale. The article’s primary claim is that the UK has moved beyond proving the model and into building the delivery layer that lets those models operate across sectors without fragmenting trust.

That shift matters because the failure mode is no longer theoretical adoption resistance. The real constraint is whether governance architecture is embedded in the platform layer, so that policy, interoperability, and access controls travel with the data rather than being added after deployment.

The article also places agentic AI inside that same delivery question. Once agents depend on verified, permissioned, current data, smart data governance stops being a sector issue and becomes part of the access model for machine-to-data relationships.

Key questions

Q: How should organisations build smart data governance into infrastructure rather than layering it on later?

A: Start by treating consent, identity, and authorisation as shared platform capabilities, not project-specific controls. That means the trust model is defined once, implemented in the exchange layer, and reused across schemes so each participant does not invent its own approval path.

Q: Why do interoperability programmes fail when governance is inconsistent across sectors?

A: They fail because participants cannot rely on the same rules for consent, authentication, liability, and data use. If each sector defines trust differently, integration work multiplies and adoption slows, even when the underlying APIs are technically sound.

Q: What breaks when AI agents are given access without identity governance?

A: What breaks is accountability. The organisation may see actions, logs, and alerts, but it cannot reliably tie them to a governed identity with clear scope and revocation. That creates uncontrolled blast radius, especially when agents can reach sensitive systems through shared tokens, delegated service accounts, or broad API access.

Q: How should security teams balance trust, innovation, and control in smart data schemes?

A: They should set a common security and consent baseline that is strong enough to protect data-sharing, but simple enough that participants can actually adopt it. The goal is reusable governance that scales with more schemes, not bespoke controls for every integration.

Technical breakdown

Governance architecture versus bolt-on controls

Smart data schemes fail when governance is treated as a post-launch policy layer instead of a design property of the infrastructure. In practical terms, consent, identity, authorisation, and interoperability have to be built into the trust fabric that brokers data exchanges across parties. Security-by-design and standards-based APIs matter because they determine whether participants can trust the exchange without recreating controls in every integration. The operational issue is not only compliance. It is whether trust can survive scaling from a few pilots to many schemes and sectors.

Practical implication: Design consent and identity controls into the shared infrastructure model, not as a separate overlay for each new scheme.

FAPI-compliant API security and consent frameworks

The article points to FAPI-compliant API security and standards-based consent and identity frameworks as the mechanisms that make interoperability workable at scale. That matters because data-sharing ecosystems are only as strong as their weakest authentication, token, or authorisation boundary. A federation model without consistent security requirements creates fragmentation, while a common framework reduces the chance that one sector becomes the trust exception. For practitioners, this is the difference between a policy declaration and an operable ecosystem.

Practical implication: Align API security, consent handling, and federated identity patterns to one shared trust model across schemes.

Agentic AI and permissioned data access

Agentic AI changes the access problem because the consumer of data may no longer be a human directly acting in a session. The article’s central implication is that an agent is only as safe as the data it can access and trust, which makes permissioning, freshness, and provenance part of the AI control surface. That does not make this an AI-model problem alone. It makes it an identity and governance problem, because the agent inherits whatever trust conditions the ecosystem exposes.

Practical implication: Treat AI agents as governed data consumers whose access rules must be explicit, current, and auditable.

NHI Mgmt Group analysis

Governance architecture, not enthusiasm, is now the limiting factor in smart data delivery. The article shows a market moving from proof-of-concept to infrastructure reality, which means the bottleneck has shifted from policy intent to operational trust design. When adoption starts to scale, the quality of the governance layer decides whether interoperability compounds or fragments. Practitioners should read this as a mandate to treat trust infrastructure as core architecture, not programme decoration.

Consent and identity are no longer separate from the delivery model of data-sharing ecosystems. The piece is explicit that security-by-design, FAPI-compliant controls, and standards-based consent frameworks are what make scale possible. That places identity governance inside the exchange fabric, where it belongs, rather than leaving it as an external approval process. The implication is that access decisions, consent artefacts, and interoperability rules must be engineered as one control system.

Smart data is becoming a machine-readability problem as much as a human usability problem. The agentic AI discussion changes the governance lens because access is no longer only about a person initiating a transaction. Once an agent can act on verified, permissioned data, the ecosystem must govern non-human consumers with the same seriousness as human ones. Practitioners should assume that the next trust gap will be machine-mediated, not user-mediated.

Cross-sector interoperability will expose weak governance faster than it exposes weak technology. The article’s international comparisons make clear that scaling by sector alone creates uneven maturity and inconsistent controls. Countries and schemes that standardise governance early tend to move faster later, because participants know how consent, liability, and access will work. That is the practical lesson for identity teams: interoperability failures usually begin as governance inconsistencies, not protocol failures.

Smart data infrastructure is becoming a reusable identity trust layer for adjacent markets. The article’s logic extends beyond open banking into property, energy, transport, and any environment that depends on shared verified data. That makes the trust framework itself a strategic asset, but only if it can support different sectors without losing common identity and consent rules. Practitioners should think in terms of portable governance, not isolated deployments.

What this signals

Governance becomes the scaling control once smart data moves beyond pilots. The practical lesson for identity teams is that interoperability will fail where consent, access, and liability are handled as separate programmes. When the exchange layer carries the trust model itself, the programme can scale without re-litigating every participant relationship.

Agentic consumption turns smart data into a non-human identity governance issue. If an agent can act on verified data, then access reviews designed for people no longer capture the real decision point. Practitioners need governance that follows the data consumer, not just the user who first granted consent.

For practitioners

• Embed governance in the platform layer Design consent, identity, and authorisation into shared infrastructure so each new scheme does not need a separate trust overlay.
• Standardise API security across schemes Adopt one security baseline for federated data exchange so authentication, token handling, and access checks behave consistently across sectors.
• Define machine-consumer governance Treat agents and other non-human consumers as governed identities with explicit access scope, current permissions, and auditable decision paths.
• Plan for interoperability before launch Set common rules for consent artefacts, liability, and participant onboarding before the first scheme goes live, so delivery does not fragment later.

Key takeaways

• Smart data is now constrained less by policy intent than by the governance architecture needed to make delivery trustworthy at scale.
• The article links interoperability, consent, and identity controls directly to whether open data schemes can move from pilots to durable infrastructure.
• Practitioners should treat agentic AI as a governed data consumer and design reusable trust controls before cross-sector scaling begins.

Key terms

• Support Data Governance: Support data governance is the set of policies and controls that determine how customer-service information is classified, accessed, retained, masked, and audited. It becomes important when tickets contain personal data, secrets, or regulated content that must not be broadly visible across teams and tools.
• Governance architecture: Governance architecture is the way policy, controls, and accountability are built into a platform so they can be executed, monitored, and enforced. For identity programmes, it determines whether rules are merely documented or actually operable in production.
• Permissioned First-Party Data: Permissioned first-party data is information a person or organization collects directly from its own users, customers, or systems with explicit authorization for a defined purpose. It is governed by consent, policy, and access controls, and may include behavioral, transactional, identity, or operational data used for security, personalization, analytics, or compliance.
• Interoperability trust boundary: An interoperability trust boundary is the point where identity and access decisions move from one organisation, application, or network to another. It is where assurance, logging, and revocation need to remain consistent even though control is shared.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.