Welcome

Passionately curious about Data, Databases and Systems Complexity. Data is ubiquitous, the database universe is dichotomous (structured and unstructured), expanding and complex. Find my Database Research at SQLToolkit.co.uk . Microsoft Data Platform MVP

"The important thing is not to stop questioning. Curiosity has its own reason for existing" Einstein



Friday, 5 June 2026

Seen but Not Heard: The Age of Data Governance

There’s a phrase I remember being told as a child  “seen but not heard.”

At the time, it meant quiet compliance. Something present, something acknowledged, but not something that shaped the room or influenced what happened next. Strangely, that’s exactly how organizations have treated data governance for years. It has always been there, in the background. Policies exist, frameworks have been written, roles have been defined. If you look hard enough, every organization can point to where governance sits. It is visible. It is documented. It is technically present but it hasn’t truly been heard. It hasn’t influenced how systems are designed, how teams deliver, or how decisions are made in the way it should. Instead, governance has often been something that follows behind delivery as a correction, a control, a necessary inconvenience once the “real work” has already been done. That made sense, once but it doesn’t any longer.



What has changed is not governance itself, it is the world around it. We now operate in organizations where data is not a by-product of activity; it is the thing everything depends on. Strategy is built on it, operations are driven by it, and increasingly, decisions are delegated to systems that rely entirely on it. There is no part of a modern organization that sits outside of data anymore and yet, governance is still too often treated as if it does. That tension is becoming impossible to ignore because when every system depends on data, every issue becomes a governance issue. When numbers do not align between reports, when teams cannot agree on definitions, when ownership is unclear, when trust in outputs begins to erode these are not technical failures in isolation. They are symptoms of something deeper: a lack of embedded governance. You can see this play out repeatedly. Organizations invest in platforms, they modernise architectures, they implement analytics solutions, they adopt AI. Each initiative is presented as progress, and in isolation, it often is. But without governance woven into the fabric of these initiatives, complexity accumulates rather than resolves. Data spreads, inconsistency grows, and the ability to explain or trust what is being produced gradually diminishes. Governance, in those moments, has been seen but it was never allowed to shape the outcome.

The emergence of AI has brought this reality into sharper focus. For years, organizations could tolerate a degree of inconsistency in their data. It caused frustration, inefficiency, and occasionally risk, but it remained manageable. AI does not allow for that tolerance. It amplifies whatever it is given. Good data becomes insight at scale. Poor data becomes risk at scale. There is no neutral outcome. The old saying “garbage in, garbage out” still applies, but it now applies faster, at greater scale, and with far more impact than before. When decisions begin to be influenced or even made by systems fed on ungoverned data, the consequences are no longer contained within individual processes. They affect entire organizations. At that point, governance is no longer a supporting capability. It becomes the condition for whether anything works at all.

This is why the idea that governance can be added later no longer holds. It is not something that can sit alongside delivery or follow it. Governance determines what “good” looks like before anything is built. It defines ownership, establishes meaning, sets expectations, and ensures consistency. Without it, delivery moves forward, but coherence does not and that is the subtle but critical shift that is still being missed. We are not entering a stage where governance becomes more important as a standalone discipline. We are entering a stage where governance becomes inseparable from everything else. It is not another workstream to manage it is part of how every workstream operates. Every technology solution carries assumptions about data. Every integration defines how data flows. Every report reflects decisions about meaning, quality, and trust. Every AI model relies on choices about what data is used and how it is interpreted. In all of these cases, governance is already present. The difference is whether it has been made explicit, intentional, and embedded or whether it remains invisible until it fails.

One of the reasons organizations struggle with this shift is that governance has historically been framed in the wrong way. It has been positioned as a control mechanism, something that restricts or slows progress. It has been documented extensively, but lived infrequently. It has often been assigned to a function rather than understood as a shared organizational responsibility. As a result, it has been treated as optional in practice, even when it is mandatory in principle but when governance is embedded properly, it does not slow organizations down. It removes uncertainty. It allows decisions to be made with confidence because there is clarity around ownership, meaning, and quality. It reduces rework because expectations are clear from the outset. It enables innovation because it provides the guardrails that make experimentation safe. In other words, it makes progress sustainable.

The irony is that most organizations are already feeling the consequences of not doing this, even if they do not describe it in those terms. The questions that surface in meetings about which version of the truth to trust, about who is responsible for a dataset, about whether something can be used safely or compliantly are all governance questions. They just are not recognised as such and because they are not recognised, they are not addressed systematically. Instead, they are solved locally, temporarily, repeatedly. Governance remains visible in theory, but unheard in practice.

We are now at a point where that is no longer viable. If data is the thing that everything depends on, then governance must be the thing that everything contains. Not as an overlay, not as an afterthought, but as a standard, embedded part of how organizations operate. This is the age of data governance — not because governance is new, but because the absence of it is no longer survivable. The organizations that recognise this will not be the ones with the most advanced tools or the largest data estates. They will be the ones that understand their data well enough to trust it, control it, and use it consistently across every part of the business. They will be the ones that stop simply seeing data governance, and finally start listening to what it has been telling them all along.

Thursday, 4 June 2026

Microsoft Announces Scout: An Always‑On Autonomous Agent for Work

Microsoft has unveiled Scout, its first Autopilot agent, an always‑on, autonomous digital assistant designed to work across Microsoft 365, proactively coordinating tasks, managing workflows, and keeping work moving even when you’re not in the loop. What makes Scout different is its ability to operate with its own identity, act within organisational policies, and build long‑term context through WorkIQ, learning how you work and what matters most. But beneath the excitement, there’s a deeper story for those of us working in data governance and Responsible AI.

Where Scout Meets Data Governance

Microsoft has been explicit: Scout is built with enterprise‑grade security, policy enforcement, and auditability from day one. Key governance‑aligned capabilities include: Policy‑constrained identity Scout acts only within the permissions and boundaries your organisation sets. Execution containers & OS‑level sandboxing  reducing risk when agents access files, run code, or interact with networks. Continuous policy conformance checks every action is validated against organisational guidelines, producing an audit trail. This is a significant shift: AI agents are no longer “black boxes” running in user sessions, they’re governed, monitored, and contained as first‑class enterprise actors.

Responsible AI: Built Into the Foundation

Microsoft has also published Responsible AI documentation for Scout, reinforcing that it is part of a broader commitment to safe, transparent, and accountable AI systems. 

Highlights include:
  • Responsible AI FAQs explaining how Scout works, what data it accesses, and how system owners can shape behaviour.  
  • Tiered permission systems for file access, shell commands, and browser automation.  
  • Human‑in‑the‑loop expectations and environmental considerations for deployment.  
This aligns Scout with Microsoft’s AI principles of fairness, reliability, safety, privacy, security, inclusiveness, transparency, and accountability.

Why This Matters

For organisations already investing in data governance, AI assurance, and operational Responsible AI, Scout represents a new category of enterprise agent:
  • Autonomous enough to reduce coordination overhead  
  • Governed enough to meet compliance and risk expectations  
  • Context‑aware enough to become a durable part of the digital workforce

This is the moment where AI agents stop being assistants and start becoming accountable digital colleagues  operating within the same governance frameworks as humans and systems.

Wednesday, 3 June 2026

Microsoft Build 2026: The Moment Governance Became the Bottleneck, Not Innovation

If last year’s narrative was about what AI can do, Microsoft Build 2026 marked a noticeable shift: the conversation has moved firmly to what organizations must control.

Across two days of announcements, Microsoft made one thing clear. The next phase of enterprise AI will not be defined by better models or more copilots. It will be defined by whether organizations can operationalise data readiness, governance, and trust at scale.

And that is where the most important announcements sit.

From “AI Features” to “AI Systems That Act”

The headline innovation at Build wasn’t just new models, it was the emergence of autonomous AI agents as first-class enterprise actors.

Microsoft introduced Scout, an always-on AI agent capable of continuously operating across enterprise systems, taking actions rather than waiting for prompts.
This marks a fundamental shift from assistive AI to operational AIsoftware that executes tasks, interacts with systems, and makes decisions within workflows. 

But this also introduces a new governance reality.

When AI moves from generating content to acting on behalf of a business, the questions change:

  • Who is accountable for the action?
  • What data did the agent access?
  • What policies constrained its behaviour?

Microsoft’s answer is not a single tool but an emerging governance architecture for agents.

Governance Is Now Part of the Platform (Not an Add-On)

Across the announcements, governance was not positioned as a compliance afterthought. It was embedded into the core platform.

Three developments stand out.

Agent identity, control, and auditability

Agents are now designed with their own identities, permissions, and audit trails that essentially are becoming governed entities within enterprise systems.
This is a critical shift: governance is no longer about users accessing data, but about non-human actors operating within policy boundaries. 

The rise of the agent control plane

With capabilities such as Agent 365 and broader governance frameworks, Microsoft is building what can only be described as a control layer for AI agents covering access control, visibility, monitoring, and compliance. 

This moves governance from static policies to continuous oversight of autonomous systems.

Built-in safety, evaluation, and testing

The introduction of evaluation frameworks like ASSERT (for testing AI behaviour against policy expectations) signals a shift toward engineering governance into the development lifecycle itself. 

This aligns closely with emerging standards (ISO/IEC 42001, EU AI Act), where governance is expected to be designed, evidenced, tested and not assumed.

Data Governance Quietly Took Centre Stage

While the headlines focused on models and agents, the more important story sits underneath: data is now the limiting factor for AI.

Microsoft’s investment in Fabric including a GPU accelerated data warehouse positioned as an execution layer for AI workloads reflects a deeper truth: organisations don’t lack AI capability, they lack AI-ready data environments. 

This reinforces a theme many of us have been seeing on the ground:

The challenge is no longer can we use AI?
It is can we trust the data, control its usage, and scale it responsibly?

Even outside the keynote announcements, updates across Microsoft Purview continue to evolve around:

  • data quality management,
  • data loss prevention for AI interactions,
  • and governance across expanding AI estates. 

Taken together, this signals a more mature positioning that data governance is not supporting AI, it is enabling it.

A New Stack: AI, Data, and Governance as One System

Perhaps the most important architectural shift is how Microsoft is framing the AI stack.

At Build 2026, governance was explicitly treated as a foundational layer alongside compute, models, and tools. 

This is subtle but significant.

Previously, governance sat outside the stack:

  • something imposed after deployment,
  • owned by risk or compliance functions,
  • often disconnected from engineering.

Now, governance is:

  • integrated into runtime environments,
  • embedded in agent frameworks,
  • and enforced through platform capabilities.

This is a move toward operational governance, not theoretical governance.

What This Means for Businesses

For organizations, these announcements are less about new features and more about a change in expectations.

AI adoption will be constrained by governance maturity

The organizations that succeed will not necessarily be those with the most advanced models but those with:

  • clear data ownership,
  • defined policies for AI usage,
  • and the ability to monitor and control AI behaviour continuously.

Governance becomes a cross-functional discipline

AI governance can no longer sit solely with data teams or compliance functions. It now spans:

  • data governance,
  • security,
  • enterprise architecture,
  • and operational risk.

Tools alone will not solve the problem

While Microsoft is building an increasingly comprehensive governance ecosystem, the platform assumes something critical:

Organisations already understand their data, risks, and policies.

In reality, many do not.

This is where the gap and the opportunity sits.

The Real Announcement wasn’t a Product

If you step back, the most important announcement at Build 2026 wasn’t a model, a Copilot update, or even an agent.

It was a shift in narrative.

Microsoft is signaling that:

  • AI is no longer experimental.
  • Agents will become embedded in everyday business operations.
  • And governance is now the primary barrier to scale.

In other words, we’ve moved from the innovation phase of AI to the industrialisation phase.

And industrialisation always introduces the same question:

How do you scale safely, consistently, and with accountability?

That is not a tooling question. It is a Data and AI governance question.

References

forbes.com  dqindia.co  theneuron.ai  microsoft.github.io  pulse2.com 

forbes.com  learn.microsoft.com  theneuron.ai

Sunday, 31 May 2026

When AI Becomes an Employee, Governance Becomes Strategy

 Two recent pieces got me thinking about where AI is really heading:

👉 AI in the agentic workplace (WEF)
👉 AI is becoming the new employee

Both challenge a core assumption many organisations are still holding on to:

AI is no longer just a tool.
It’s becoming part of the workforce.

The WEF describes AI as a new colleague, embedded into workflows, reshaping how work is done and how organisations are structured. The AI as employee view goes further positioning agents as digital workers that can own tasks, make decisions, and contribute to outcomes. There is a gap I don’t see enough people talking about are we accelerating adoption faster than we are defining governance.

If AI starts to behave like a workforce participant, then the questions shift:

  • What data is it allowed to access and under what controls?
  • How do we ensure decisions are explainable, auditable, and fair?
  • Who is accountable when an AI employee gets it wrong?
  • How do we assign roles, permissions, and boundaries to non-human actors?

This is where data governance and Responsible AI stop being supporting disciplines and become the foundation of the operating model. Because the future isn’t just AI-enabled teams, it’s human + AI workforce design:

  • AI agents operating across governed data domains
  • Decisions driven by data that must be trusted, lineage-tracked, and policy-controlled
  • Hybrid teams where accountability, not just capability, must be clearly defined

And this is the real shift:

  • From AI as capability → AI as organisational entity
  • From model governance → workforce governance
  • From policies on paper → operationalised controls across data, AI, and people

The organisations that get ahead won’t be the ones who deploy the most AI. They’ll be the ones who:

  • Treat AI access to data as a governed privilege, not an entitlement
  • Design AI roles with the same rigour as human roles
  • Embed responsible AI principles into day-to-day execution not just frameworks

Because if AI is becoming the new employee then governance is no longer optional. It’s how you stay in control.


References

https://www.weforum.org/stories/2026/01/ai-agentic-workplace-human-resources/ https://open.substack.com/pub/nidgguy/p/ai-is-becoming-the-new-employee?utm_campaign=post-expanded-share&utm_medium=web

assets.kpmg.com

Monday, 18 May 2026

Governing the agents not just the AI

The current wave of agentic AI is not just another iteration of automation, it is a shift from models that advise to systems that act. In the Fortune piece summarised via Yale Insights, the central risk is not capability but placement: where agents are deployed in the business and how close they operate to customers, decisions and trust. The “proximity framework” highlights that the closer an agent gets to irreversible, customer-facing decisions, the greater the governance burden becomes, with failures having disproportionate reputational impact. What is emerging consistently across follow-on work in banking, healthcare, retail and supply chain is that governance is lagging deployment, with organizations actively running agents across operations while still relying on fragmented or incomplete control models. This reinforces a point you often make in governance conversations: the problem is no longer whether AI works, but whether organizations can safely operationalise decision rights at scale. 

When you bring data governance into this, the conversation sharpens significantly. Multiple recent articles move beyond model governance and focus specifically on how agents access and use data, often autonomously and continuously. Agent Access Management reframes governance as a data problem, not just identity, because agents inherit permissions dynamically across APIs, workflows and services, often without visibility into what they can actually reach. Traditional access governance breaks here because it assumes static roles and human review cycles, whereas agents operate continuously and at machine speed, creating access patterns that are technically authorised but contextually inappropriate. This is why newer guidance emphasises data-aware controls, real-time monitoring and understanding not just who the agent is, but what data it is using and why. It aligns strongly with emerging audit expectations, where organizations must evidence which agents exist, what data they access, and how decisions are controlled and explained. 

What is becoming clear across the literature is that governance for agents is not an extension of traditional AI governance, it is a redesign of enterprise control models. Firms like IBM and McKinsey point out that governance needs to move from validating outputs to controlling actions, defining scope, ownership and accountability for autonomous decision-making. At the same time, platform and vendor ecosystems are converging on concepts like control planes, agent registries and data-centric governance layers to ensure visibility and enforce policy at runtime. The consistent thread across all of this is that trust in agentic AI is not built at the model layer, it is built at the data access and execution layer. That is where governance now has to operate, and it is where most organisations are still weakest. 

References

Fortune / Yale source 

Supporting governance and agentic AI articles

Agent governance frameworks and operating model shifts

Data access governance and agent-specific governance

Audit, compliance and enterprise deployment considerations

Thursday, 14 May 2026

From governance frameworks to enforceable control capabilities

For many organizations, the challenge is not a lack of data governance frameworks, but a gap between principles and practice. Discussions around Microsoft Purview often focus on individual features, while governance frameworks such as DAMA, ISO, or emerging AI regulations describe what should exist at a conceptual level. What organizations actually need is a capability‑led view: a clear map that shows which governance needs exist, how those needs are implemented through concrete Purview capabilities, and where accountability typically sits across the business. This capability perspective bridges strategy, regulation, and day‑to‑day delivery turning governance intent into enforceable, operational controls.

The difference in views:

  • Most Purview discussions list features.
  • Most governance frameworks describe principles.

What organizations actually need is a capability map showing:

  • Which governance need exists
  • Which Purview capability supports it
  • Who typically owns it

This table‑driven view bridges strategy, regulation, and day‑to‑day operations.

Microsoft Purview Capability Mapping Table

Governance CapabilityPurview ToolingPrimary Framework AlignmentTypical Accountable Role
Enterprise data discoveryData MapDAMA – Metadata MgmtData Governance Office
Business data understandingUnified CatalogDAMA – Data GovernanceData Owners / Stewards
Metadata managementUnified CatalogDAMA / ISO 38505Data Governance
Data lineageLineageDAMA / AI Act Art.10Data Engineering
Data quality signalsData Estate InsightsDAMA / ISO 8000Data Quality Lead
Sensitive data classificationInformation ProtectionISO / AI ActSecurity & Privacy
Persistent protectionSensitivity LabelsISO / GDPR / AI ActSecurity
Data loss preventionDLPISO / RegulatorySecurity Operations
Insider risk monitoringInsider Risk MgmtISO accountabilitySecurity & HR
AI data risk visibilityDSPMAI ActSecurity & Governance
Audit loggingAuditISO / AI ActLegal & Compliance
Regulatory control mappingCompliance ManagerISO / AI ActRisk & Compliance
Legal investigationseDiscoveryISO / RegulatoryLegal
Retention & disposalRecords MgmtISO / GDPRInformation Management

Why this matters for AI governance

The AI Act does not introduce new governance concepts, it enforces existing ones at AI scale.

Purview’s strength is that:

  • The same sensitivity labels used in email
  • Also govern datasets
  • Also constrain AI interactions
  • Also support legal discovery

This continuity is exactly what auditors and regulators expect.

Common implementation mistake to avoid

Treating Purview as a security tool
Treating governance as policy documentation
Treating AI governance as separate

Treat governance as a cross‑functional operating model and use Purview as the control fabric beneath it.  Thinking of 

  • Frameworks that define intent.
  • Regulation that demands proof.
  • Tools that deliver evidence.

Microsoft Purview sits at the intersection not as a framework replacement, but as the mechanism that allows modern data governance to function at scale.

Wednesday, 13 May 2026

Microsoft's Agentic Transformation Patterns Playbook.

Microsoft has released an Agentic Transformation Patterns Playbook.


The Agentic Transformation Patterns Playbook A practical guide to choosing, scaling, and operating AI agents across your organization. It helps with understanding the landscape and identifying patterns. It is a well defined playbook on how to progress well with Agentic AI.

The Agentic Transformation Patterns Playbook sets out practical patterns for moving from isolated AI experiments to governed, enterprise‑scale AI agents that can plan, act, and collaborate across systems. Its core message is that agentic AI is not a tooling challenge but an operating‑model shift, requiring clear accountability, proportionate governance, and risk‑based controls as autonomy increases. Used well, the patterns help organisations scale AI safely by design embedding oversight, auditability, and human control without slowing down adoption.

The maturity model shared helps prioritize action by looking at AI Strategy & Experience, Business Strategy, AI Governance & Security, Technology & Data  and Organization & Culture. These capability drivers:

  • AI Strategy & Experience: How deliberately you plan, invest in, and evolve AI across the organization
  • Business Strategy: How deeply AI is integrated into business processes and outcome measurement
  • AI Governance & Security: How well you manage risk, compliance, monitoring, and responsible AI
  • Technology & Data: How mature your platforms, architecture, data quality, and telemetry are
  • Organization & Culture: How effectively you enable adoption, build skills, and foster AI-positive culture

The maturity model is described: https://aka.ms/AgentMaturityModel

The Agentic  Center of Excellence (CoE) has 4 functions, governs, enables, optimizes and scales. Governs has those release gates to ensure nothing goes to production  without review. The audit logs taking on a key governance roll tracking who built and approved it and what it does. There are a set of 6 roles identified that must work together to scale agents. Compliance is continuous and is not a one time check. An important message Won't let anyone ship until governance is 'complete.' Governance is never complete.

The Agentic CoE adds agent-specific capabilities to existing governance, security & Compliance, Cloud/IT Governance, Low Code/ Power Platform CoE, Microsoft 365 Governance and Responsible AI Council. It does not replace what works — it fills the gaps that agents create (ownership, lifecycle, decision rights, monitoring).