What Data Governance Do AI Agents Need in a Mid-Size Company?
A mid-size company needs five pieces of data governance before an AI agent touches live data: a one page register of every dataset each agent reads or writes, four sensitivity classes, a separate login for every agent with the narrowest access that does the job, a log of every read and write kept for 12 months, and one named owner who signs off each dataset. That's 2 to 3 weeks of work for the first agent, and it costs far less than finding out later what an agent could see.
Why companies get data governance wrong
Most companies I walk into have one of two problems. Either nobody has thought about it, and the first agent runs on an admin login someone in IT lent it, or the legal team has written a 30 page AI policy and no agent has gone live in 9 months.
The admin login is the dangerous one. An agent built to code supplier invoices only needs 4 fields from the ledger. On an admin login it can read payroll, the board pack and every customer's bank details. Nothing goes wrong until the day a prompt pulls in the wrong file, and then you can't say what it saw, because nothing was logged.
The 30 page policy fails the other way. It talks about AI in general, so nobody can tell whether the invoice agent is allowed or not. Every request goes to a committee that meets once a month. I'd rather have one page per agent that a finance manager can read in 5 minutes.
The five pieces I put in place
1. A one page access register for each agent
Before an agent is built, I write down every dataset it touches. For each one: the system, the tables or folders, whether the agent reads or writes, the sensitivity class and the owner. A typical first agent touches 3 to 6 datasets, so the register fits on one page. If it doesn't fit, the agent is doing too much and I split it.
2. Four sensitivity classes, with a rule for each
I don't use the 7 tier schemes that come out of big company security teams. Four classes cover a company of 30 to 500 people, and each one comes with a rule an agent can follow.
| Class | Examples | Agent rule |
|---|---|---|
| Public | Website, price list, published accounts | Read freely |
| Internal | Policies, product docs, supplier list | Read if on the register |
| Confidential | Customer records, ledger, contracts, pipeline | Read named fields only, writes go to a draft a person approves |
| Restricted | Bank details, salaries, health data, passwords | Masked or summed before the agent sees it, never written |
Classing the data takes 1 or 2 days for the systems the first agent uses. You don't class the whole company up front. You class each dataset the first time an agent asks for it.
3. A separate login for every agent
Every agent gets its own service account. It never borrows a person's login, and two agents never share one. The account gets the narrowest access that does the job, at field level where the system allows it. When an agent is retired, its account is switched off the same day. I review every agent account once a quarter against its register, and in my experience about 1 in 5 has picked up access it no longer uses.
4. A log of every read and write, kept 12 months
For each run the log records which records the agent read, what it wrote, which instruction it was following and who approved the output. I keep it for 12 months, or longer if your retention policy says so. Two things make the log worth having. An auditor can trace any posted entry back to its source in under 10 minutes. And when a customer asks what happened to their data, you can answer with a list instead of a guess.
5. One named owner per dataset
Every dataset on a register has one named owner who signs it off before the agent goes live. The finance manager owns the ledger, the head of sales owns the CRM, HR owns the staff records. Any change to what an agent can read goes back to that owner, and they answer within 2 working days. A name works better than a committee because the name answers.
From Hayat's operating seat
I'm Hayat Amin, an AI-native CFO, AI operator and AI coach for CFOs who teaches finance leaders how to build AI into finance operations. I spent twenty years in the C-suite, with three exits and three FT100 listings. Now I build and run AI agent systems inside companies, across finance, sales pipeline, onboarding and compliance evidence, and I coach CFOs one to one.
Every agent I run has its own register. The overnight pipeline research agent reads the CRM and public sources and writes notes to a draft field, never to the deal stage. The cash runway agent reads the bank feed and the ledger and can't write to either. The onboarding agent that answers a joiner in their own language reads the policy library and has no route to payroll at all. When I sold companies, due diligence asked who could see what, and how we knew. With agents the same question comes up, and the register and the log answer it in an afternoon.
Do I need a data governance team before using AI agents?
No. A company of 30 to 500 people doesn't need a data governance team to start. It needs one person who holds the register, usually the CFO, the COO or the head of operations, and about 2 hours a week. The owners of each dataset are people who already exist: the finance manager owns the ledger, the head of sales owns the CRM. Hire a specialist when you pass 10 agents.
What data should AI agents never be able to read?
Passwords, API keys, full card numbers and full bank account details should never reach an agent in readable form. Health records and anything covered by a court order come next. If an agent needs to match a bank account, give it the last 4 digits. If it needs to check a payroll total, give it the total, not the 140 lines of salaries behind it.
How does GDPR apply when AI agents use customer data?
Personal data stays personal data whatever reads it. If an agent processes customer or staff records, the model provider is a processor, so you need a data processing agreement with them, a line in your record of processing, and a contract term that says they don't train on your data. I check all three before an agent reads a single customer record.
Where I come in
This is part of what I set up inside companies before the first agent goes live. I write the register with your dataset owners, class the data the agent needs, set up the logins and the log, and then build and run the agent on top. If your data isn't in shape yet, start with how to get your data ready for AI agents and how to make agents safe enough for real operations. Finance leaders can start at AI for CFOs. Could you name today which of your datasets your first agent would read? See how I work on data and IP strategy, or start at meethayat.com and tell me.