Welcome

Passionately curious about Data, Databases and Systems Complexity. Data is ubiquitous, the database universe is dichotomous (structured and unstructured), expanding and complex. Find my Database Research at SQLToolkit.co.uk . Microsoft Data Platform MVP

"The important thing is not to stop questioning. Curiosity has its own reason for existing" Einstein



Wednesday, 3 June 2026

Microsoft Build 2026: The Moment Governance Became the Bottleneck, Not Innovation

If last year’s narrative was about what AI can do, Microsoft Build 2026 marked a noticeable shift: the conversation has moved firmly to what organizations must control.

Across two days of announcements, Microsoft made one thing clear. The next phase of enterprise AI will not be defined by better models or more copilots. It will be defined by whether organizations can operationalise data readiness, governance, and trust at scale.

And that is where the most important announcements sit.

From “AI Features” to “AI Systems That Act”

The headline innovation at Build wasn’t just new models, it was the emergence of autonomous AI agents as first-class enterprise actors.

Microsoft introduced Scout, an always-on AI agent capable of continuously operating across enterprise systems, taking actions rather than waiting for prompts.
This marks a fundamental shift from assistive AI to operational AIsoftware that executes tasks, interacts with systems, and makes decisions within workflows. 

But this also introduces a new governance reality.

When AI moves from generating content to acting on behalf of a business, the questions change:

  • Who is accountable for the action?
  • What data did the agent access?
  • What policies constrained its behaviour?

Microsoft’s answer is not a single tool but an emerging governance architecture for agents.

Governance Is Now Part of the Platform (Not an Add-On)

Across the announcements, governance was not positioned as a compliance afterthought. It was embedded into the core platform.

Three developments stand out.

Agent identity, control, and auditability

Agents are now designed with their own identities, permissions, and audit trails that essentially are becoming governed entities within enterprise systems.
This is a critical shift: governance is no longer about users accessing data, but about non-human actors operating within policy boundaries. 

The rise of the agent control plane

With capabilities such as Agent 365 and broader governance frameworks, Microsoft is building what can only be described as a control layer for AI agents covering access control, visibility, monitoring, and compliance. 

This moves governance from static policies to continuous oversight of autonomous systems.

Built-in safety, evaluation, and testing

The introduction of evaluation frameworks like ASSERT (for testing AI behaviour against policy expectations) signals a shift toward engineering governance into the development lifecycle itself. 

This aligns closely with emerging standards (ISO/IEC 42001, EU AI Act), where governance is expected to be designed, evidenced, tested and not assumed.

Data Governance Quietly Took Centre Stage

While the headlines focused on models and agents, the more important story sits underneath: data is now the limiting factor for AI.

Microsoft’s investment in Fabric including a GPU accelerated data warehouse positioned as an execution layer for AI workloads reflects a deeper truth: organisations don’t lack AI capability, they lack AI-ready data environments. 

This reinforces a theme many of us have been seeing on the ground:

The challenge is no longer can we use AI?
It is can we trust the data, control its usage, and scale it responsibly?

Even outside the keynote announcements, updates across Microsoft Purview continue to evolve around:

  • data quality management,
  • data loss prevention for AI interactions,
  • and governance across expanding AI estates. 

Taken together, this signals a more mature positioning that data governance is not supporting AI, it is enabling it.

A New Stack: AI, Data, and Governance as One System

Perhaps the most important architectural shift is how Microsoft is framing the AI stack.

At Build 2026, governance was explicitly treated as a foundational layer alongside compute, models, and tools. 

This is subtle but significant.

Previously, governance sat outside the stack:

  • something imposed after deployment,
  • owned by risk or compliance functions,
  • often disconnected from engineering.

Now, governance is:

  • integrated into runtime environments,
  • embedded in agent frameworks,
  • and enforced through platform capabilities.

This is a move toward operational governance, not theoretical governance.

What This Means for Businesses

For organizations, these announcements are less about new features and more about a change in expectations.

AI adoption will be constrained by governance maturity

The organizations that succeed will not necessarily be those with the most advanced models but those with:

  • clear data ownership,
  • defined policies for AI usage,
  • and the ability to monitor and control AI behaviour continuously.

Governance becomes a cross-functional discipline

AI governance can no longer sit solely with data teams or compliance functions. It now spans:

  • data governance,
  • security,
  • enterprise architecture,
  • and operational risk.

Tools alone will not solve the problem

While Microsoft is building an increasingly comprehensive governance ecosystem, the platform assumes something critical:

Organisations already understand their data, risks, and policies.

In reality, many do not.

This is where the gap and the opportunity sits.

The Real Announcement wasn’t a Product

If you step back, the most important announcement at Build 2026 wasn’t a model, a Copilot update, or even an agent.

It was a shift in narrative.

Microsoft is signaling that:

  • AI is no longer experimental.
  • Agents will become embedded in everyday business operations.
  • And governance is now the primary barrier to scale.

In other words, we’ve moved from the innovation phase of AI to the industrialisation phase.

And industrialisation always introduces the same question:

How do you scale safely, consistently, and with accountability?

That is not a tooling question. It is a Data and AI governance question.

References

forbes.com  dqindia.co  theneuron.ai  microsoft.github.io  pulse2.com 

forbes.com  learn.microsoft.com  theneuron.ai

Sunday, 31 May 2026

When AI Becomes an Employee, Governance Becomes Strategy

 Two recent pieces got me thinking about where AI is really heading:

👉 AI in the agentic workplace (WEF)
👉 AI is becoming the new employee

Both challenge a core assumption many organisations are still holding on to:

AI is no longer just a tool.
It’s becoming part of the workforce.

The WEF describes AI as a new colleague, embedded into workflows, reshaping how work is done and how organisations are structured. The AI as employee view goes further positioning agents as digital workers that can own tasks, make decisions, and contribute to outcomes. There is a gap I don’t see enough people talking about are we accelerating adoption faster than we are defining governance.

If AI starts to behave like a workforce participant, then the questions shift:

  • What data is it allowed to access and under what controls?
  • How do we ensure decisions are explainable, auditable, and fair?
  • Who is accountable when an AI employee gets it wrong?
  • How do we assign roles, permissions, and boundaries to non-human actors?

This is where data governance and Responsible AI stop being supporting disciplines and become the foundation of the operating model. Because the future isn’t just AI-enabled teams, it’s human + AI workforce design:

  • AI agents operating across governed data domains
  • Decisions driven by data that must be trusted, lineage-tracked, and policy-controlled
  • Hybrid teams where accountability, not just capability, must be clearly defined

And this is the real shift:

  • From AI as capability → AI as organisational entity
  • From model governance → workforce governance
  • From policies on paper → operationalised controls across data, AI, and people

The organisations that get ahead won’t be the ones who deploy the most AI. They’ll be the ones who:

  • Treat AI access to data as a governed privilege, not an entitlement
  • Design AI roles with the same rigour as human roles
  • Embed responsible AI principles into day-to-day execution not just frameworks

Because if AI is becoming the new employee then governance is no longer optional. It’s how you stay in control.


References

https://www.weforum.org/stories/2026/01/ai-agentic-workplace-human-resources/ https://open.substack.com/pub/nidgguy/p/ai-is-becoming-the-new-employee?utm_campaign=post-expanded-share&utm_medium=web

assets.kpmg.com

Monday, 18 May 2026

Governing the agents not just the AI

The current wave of agentic AI is not just another iteration of automation, it is a shift from models that advise to systems that act. In the Fortune piece summarised via Yale Insights, the central risk is not capability but placement: where agents are deployed in the business and how close they operate to customers, decisions and trust. The “proximity framework” highlights that the closer an agent gets to irreversible, customer-facing decisions, the greater the governance burden becomes, with failures having disproportionate reputational impact. What is emerging consistently across follow-on work in banking, healthcare, retail and supply chain is that governance is lagging deployment, with organizations actively running agents across operations while still relying on fragmented or incomplete control models. This reinforces a point you often make in governance conversations: the problem is no longer whether AI works, but whether organizations can safely operationalise decision rights at scale. 

When you bring data governance into this, the conversation sharpens significantly. Multiple recent articles move beyond model governance and focus specifically on how agents access and use data, often autonomously and continuously. Agent Access Management reframes governance as a data problem, not just identity, because agents inherit permissions dynamically across APIs, workflows and services, often without visibility into what they can actually reach. Traditional access governance breaks here because it assumes static roles and human review cycles, whereas agents operate continuously and at machine speed, creating access patterns that are technically authorised but contextually inappropriate. This is why newer guidance emphasises data-aware controls, real-time monitoring and understanding not just who the agent is, but what data it is using and why. It aligns strongly with emerging audit expectations, where organizations must evidence which agents exist, what data they access, and how decisions are controlled and explained. 

What is becoming clear across the literature is that governance for agents is not an extension of traditional AI governance, it is a redesign of enterprise control models. Firms like IBM and McKinsey point out that governance needs to move from validating outputs to controlling actions, defining scope, ownership and accountability for autonomous decision-making. At the same time, platform and vendor ecosystems are converging on concepts like control planes, agent registries and data-centric governance layers to ensure visibility and enforce policy at runtime. The consistent thread across all of this is that trust in agentic AI is not built at the model layer, it is built at the data access and execution layer. That is where governance now has to operate, and it is where most organisations are still weakest. 

References

Fortune / Yale source 

Supporting governance and agentic AI articles

Agent governance frameworks and operating model shifts

Data access governance and agent-specific governance

Audit, compliance and enterprise deployment considerations

Thursday, 14 May 2026

From governance frameworks to enforceable control capabilities

For many organizations, the challenge is not a lack of data governance frameworks, but a gap between principles and practice. Discussions around Microsoft Purview often focus on individual features, while governance frameworks such as DAMA, ISO, or emerging AI regulations describe what should exist at a conceptual level. What organizations actually need is a capability‑led view: a clear map that shows which governance needs exist, how those needs are implemented through concrete Purview capabilities, and where accountability typically sits across the business. This capability perspective bridges strategy, regulation, and day‑to‑day delivery turning governance intent into enforceable, operational controls.

The difference in views:

  • Most Purview discussions list features.
  • Most governance frameworks describe principles.

What organizations actually need is a capability map showing:

  • Which governance need exists
  • Which Purview capability supports it
  • Who typically owns it

This table‑driven view bridges strategy, regulation, and day‑to‑day operations.

Microsoft Purview Capability Mapping Table

Governance CapabilityPurview ToolingPrimary Framework AlignmentTypical Accountable Role
Enterprise data discoveryData MapDAMA – Metadata MgmtData Governance Office
Business data understandingUnified CatalogDAMA – Data GovernanceData Owners / Stewards
Metadata managementUnified CatalogDAMA / ISO 38505Data Governance
Data lineageLineageDAMA / AI Act Art.10Data Engineering
Data quality signalsData Estate InsightsDAMA / ISO 8000Data Quality Lead
Sensitive data classificationInformation ProtectionISO / AI ActSecurity & Privacy
Persistent protectionSensitivity LabelsISO / GDPR / AI ActSecurity
Data loss preventionDLPISO / RegulatorySecurity Operations
Insider risk monitoringInsider Risk MgmtISO accountabilitySecurity & HR
AI data risk visibilityDSPMAI ActSecurity & Governance
Audit loggingAuditISO / AI ActLegal & Compliance
Regulatory control mappingCompliance ManagerISO / AI ActRisk & Compliance
Legal investigationseDiscoveryISO / RegulatoryLegal
Retention & disposalRecords MgmtISO / GDPRInformation Management

Why this matters for AI governance

The AI Act does not introduce new governance concepts, it enforces existing ones at AI scale.

Purview’s strength is that:

  • The same sensitivity labels used in email
  • Also govern datasets
  • Also constrain AI interactions
  • Also support legal discovery

This continuity is exactly what auditors and regulators expect.

Common implementation mistake to avoid

Treating Purview as a security tool
Treating governance as policy documentation
Treating AI governance as separate

Treat governance as a cross‑functional operating model and use Purview as the control fabric beneath it.  Thinking of 

  • Frameworks that define intent.
  • Regulation that demands proof.
  • Tools that deliver evidence.

Microsoft Purview sits at the intersection not as a framework replacement, but as the mechanism that allows modern data governance to function at scale.

Wednesday, 13 May 2026

Microsoft's Agentic Transformation Patterns Playbook.

Microsoft has released an Agentic Transformation Patterns Playbook.


The Agentic Transformation Patterns Playbook A practical guide to choosing, scaling, and operating AI agents across your organization. It helps with understanding the landscape and identifying patterns. It is a well defined playbook on how to progress well with Agentic AI.

The Agentic Transformation Patterns Playbook sets out practical patterns for moving from isolated AI experiments to governed, enterprise‑scale AI agents that can plan, act, and collaborate across systems. Its core message is that agentic AI is not a tooling challenge but an operating‑model shift, requiring clear accountability, proportionate governance, and risk‑based controls as autonomy increases. Used well, the patterns help organisations scale AI safely by design embedding oversight, auditability, and human control without slowing down adoption.

The maturity model shared helps prioritize action by looking at AI Strategy & Experience, Business Strategy, AI Governance & Security, Technology & Data  and Organization & Culture. These capability drivers:

  • AI Strategy & Experience: How deliberately you plan, invest in, and evolve AI across the organization
  • Business Strategy: How deeply AI is integrated into business processes and outcome measurement
  • AI Governance & Security: How well you manage risk, compliance, monitoring, and responsible AI
  • Technology & Data: How mature your platforms, architecture, data quality, and telemetry are
  • Organization & Culture: How effectively you enable adoption, build skills, and foster AI-positive culture

The maturity model is described: https://aka.ms/AgentMaturityModel

The Agentic  Center of Excellence (CoE) has 4 functions, governs, enables, optimizes and scales. Governs has those release gates to ensure nothing goes to production  without review. The audit logs taking on a key governance roll tracking who built and approved it and what it does. There are a set of 6 roles identified that must work together to scale agents. Compliance is continuous and is not a one time check. An important message Won't let anyone ship until governance is 'complete.' Governance is never complete.

The Agentic CoE adds agent-specific capabilities to existing governance, security & Compliance, Cloud/IT Governance, Low Code/ Power Platform CoE, Microsoft 365 Governance and Responsible AI Council. It does not replace what works — it fills the gaps that agents create (ownership, lifecycle, decision rights, monitoring).



Saturday, 9 May 2026

How Data Governance Frameworks Converge

From DAMA to ISO to the EU AI Act how Data Governance frameworks converge and how Microsoft Purview operationalises them is important to understand. Organizations rarely struggle because they lack frameworks. They struggle because frameworks remain theoretical while data, AI and regulation operate at scale.

DAMA‑DMBOK, ISO data governance standards, and the EU AI Act all address the same core problem from different angles:

  • DAMA defines what good data management looks like
  • ISO defines how governance should be assured and audited
  • The AI Act defines where governance becomes legally mandatory

Understanding where these overlap and how tooling like Microsoft Purview can operationalise them is now essential for any organization deploying analytics, automation, or AI in production.

DAMA‑DMBOK: The authoritative body of knowledge

DAMA‑DMBOK is a vendor‑neutral reference framework that defines data management as an enterprise capability, with Data Governance at its core. It establishes what must exist, without prescribing technology. [dama.org]

Key DAMA governance expectations

  • Ownership and accountability for data assets
  • Enterprise metadata and lineage
  • Data quality management
  • Security, privacy, and ethical data use
  • Stewardship and domain governance

Critically, DAMA positions metadata, lineage, and quality as foundational the same elements now required by AI regulation and ISO assurance.

ISO standards: Governing data as an accountable asset

ISO standards translate governance principles into assurable controls.

Key standards relevant to data & AI governance

  • ISO/IEC 38505‑1: Governance of data within IT governance
  • ISO 8000: Data quality management
  • ISO/IEC 25642: Data collaboration and controlled data reuse

ISO explicitly frames data as a managed, governed organizational asset that should consider value, risk, and compliance. 

Where DAMA explains what to govern, ISO defines:

  • Who is accountable
  • How governance is monitored
  • How conformance is evidenced

This distinction becomes critical for regulatory audits.

The EU AI Act is when governance becomes mandatory

The EU AI Act, particularly Article 10, legally mandates data governance for high‑risk AI systems. 

Article 10 explicitly requires:

  • Documented data sources and provenance
  • Training, validation, and test data quality controls
  • Bias detection and mitigation
  • Dataset representativeness and contextual relevance
  • Ongoing governance across the AI lifecycle

In effect, the AI Act codifies long‑standing DAMA and ISO principles into law. Non‑compliance now carries legal, financial, and reputational risk.

There is an update to the EU AI Act where EU leaders have agreed to amendments.  The official regulation it is hoped will be passed before the 2 August 2026. A delay of enforcement date has been shared for high-risk AI systems from 2 August 2026 to 2 December 2027 for AI systems listed in Annex III and 2 August 2028 for AI systems covered by Annex I). 

Where the frameworks align

Governance ConcernDAMA‑DMBOKISOEU AI Act
Data ownership & accountability
Metadata & lineage✔ (Article 10)
Data quality management✔ (ISO 8000)
Bias & ethical useEmergingPartial✔ Explicit
Audit & assuranceIndirect✔ Core✔ Mandatory
Lifecycle governance

This convergence means organizations no longer need separate governance programs, they need one operating model that satisfies all three.

Where Microsoft Purview fits

Microsoft Purview does not replace DAMA, ISO, or the AI Act. It operationalises them.

Purview provides:

  • Metadata capture and lineage at scale
  • Policy‑driven classification and protection
  • Evidence‑based compliance reporting
  • Continuous monitoring across data and AI usage

This allows governance teams to move from declared compliance to demonstrable controlDAMA tells you what good looks like. ISO tells auditors how you prove it. The AI Act tells regulators what you must do. The future of data governance is not choosing between these, it is designing one governance model that satisfies all three.

Friday, 8 May 2026

Data governance explained: Tools, pitfalls and how to get it right

Here are the key action points for establishing a successful data governance strategy based on the video "Data governance explained: Tools, pitfalls and how to get it right," 

Align with Business Strategy
​Start with the "Why": Identify the specific business needs, such as compliance (GDPR, AI Act), fundraising, or medical records [04:18].
​Treat Data as an Asset: Data governance must flow from the top of the organization down to the bottom, rather than being treated as a side project [02:21].
​Focus on Use Cases: Define how data governance will help the business specifically—whether it's for better reporting, compliance, or making costly business decisions [03:33].

Establish Roles and Ownership
​Identify Data Owners: Determine who is responsible for your "critical business assets." You cannot govern everything at once, so prioritize the most important data [10:24].
​Appoint Data Stewards: Assign individuals to manage the day-to-day operational quality of the data within their specific departments (e.g., Finance, Product, Service teams) [10:38].
​Create a Governance Model: Set up a central "meeting place" or committee where people from different parts of the business can talk and manage data issues together [09:44].

Build the Foundation (Before Tooling)
​Develop a Business Glossary: Create clear, shared definitions for terms. Different departments often use the same words to mean different things, leading to confusion [05:18].
​Assess Data Quality: Be honest about the current state of your data. Talk to team members to identify which data sets are trusted and which are "bad" [10:49].
​Avoid "Boiling the Ocean": Don't try to govern all 100+ tools at once. Start small with 3-5 business-critical assets and scale from there [12:32].

Implement the Right Tools
​Automate to Scale: Use tools like Microsoft Purview to scan data sets and automate processes that are too large to handle manually [02:54].
​Bridge the Gap: Ensure the technical team (who deploys the tool) and the business users (who use the data) are not disconnected. The tool is only effective if the business processes are mapped into it [03:01].
​Leverage Frameworks: Use established frameworks (like the CDMC framework) to guide your rollout and ensure you are meeting industry standards [11:49].

Foster a Data Culture
​Prioritize Data Literacy: Invest in training so that employees understand the importance of data and how to manage it as part of their daily operations [08:19].
​Be Proactive: Move away from "reactive" governance (only fixing things when they break or for audits) toward a proactive culture where governance is embedded in every project, especially AI [08:39].
​Watch the full video here: