Topic starter
10/07/2026 9:09 pm
TL;DR: Governance as code is expanding from cloud hygiene into AI infrastructure and data platforms, according to Stacklet, because modern estates now include GPU fleets, model serving endpoints, training pipelines, and autonomous provisioning that outpace manual review. The control problem has shifted from finding misconfigurations to enforcing policy continuously as close to creation time as possible.
Editorial analysis by NHI Mgmt Group, based on content published by Stacklet: “10 Years of Keeping the Cloud Clean With Cloud Custodian”.
Key questions
Q: What breaks when governance sits outside the AI workflow?
A: Controls become periodic and partial.
Q: Why does autonomous provisioning create a governance risk for cloud and AI teams?
A: Because the control assumption changes.
Q: What are the signs that access governance is failing in practice?
A: The clearest signs are slow remediation, repeated rubber stamp access reviews, and missed permissions outside traditional HR linked systems.
Practitioner guidance
- Extend governance policies to AI infrastructure Apply the same policy logic used for cloud resources to GPU fleets, model endpoints, and training pipelines so AI workloads are checked at creation time.
- Bind enforcement to provisioning pipelines Move controls into CI, admission, and deployment workflows so drift is blocked before resources reach production, especially where non-human identities create infrastructure.
- Unify cloud and data platform governance Cover Snowflake and Databricks with the same exception handling and remediation model used for cloud estates so access, sharing, and idle compute are governed continuously.
Bottom line: Governance as code is shifting from cloud configuration cleanup to continuous enforcement across AI and data workloads.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:32 pm
Governance as code is becoming an identity governance problem as much as a cloud controls problem: once AI agents and automated pipelines can create infrastructure, the decisive control point shifts to issuance and policy enforcement. That means non-human actors are no longer just workload consumers, they are governance participants. Practitioners should treat creation-time policy as part of identity and privilege governance, not as a separate cloud hygiene activity.
A question worth separating out:
Q: Should teams govern AI workloads and data platforms through the same control model?
A: Yes, when the operational problem is continuous policy enforcement across shared infrastructure. Cloud, AI, and data platforms now produce similar risks: sprawl, access drift, and uncontrolled change. A single governance model reduces fragmentation, but only if it can express platform-specific exceptions without losing consistency.
👉 Read our full editorial: Governance as code now spans cloud, AI, and data workloads