Trusted AI Starts With Trusted Data: Why Governance Must Evolve For The Agentic Era
By Tony Grout, Chief Product and Technology Officer at M-Files.
gettyFor years, conversations around AI governance have mainly focused on the models themselves: Are they secure? Are they biased? Those questions still matter, but they’re no longer enough.
As organizations move from AI assistants to AI agents that make important decisions, governance needs to evolve. If businesses don’t evolve, they risk letting an autonomous system act on incomplete, disconnected or untrustworthy information.
Trusted AI doesn’t begin with the model. It begins with trusted data. Organizations that recognize this shift early are better prepared to scale AI safely and effectively. Those that don’t risk creating fleets of intelligent systems capable of making very expensive and detrimental mistakes.
One word has quickly become synonymous with enterprise AI: context. Historically, enterprise software applications have forced workers to search for information manually. They had to know where specific documents lived, which application contained the latest version, and how different pieces of information fit together. AI changes that expectation.
Instead of asking people to assemble context themselves, modern AI can surface the right information based on the situation. That’s a significant step forward, but only if the context itself is secure.
Take a field engineer, for example. Instead of searching through hundreds of manuals to service industrial equipment, AI can identify the specific engine, understand where it’s installed, retrieve its service history and recommend the right repairs. The engineer isn’t simply receiving documents. They’re getting real business context to complete their work more efficiently.
That same principle applies across every industry. A contract isn’t just a document; it’s connected to customers, suppliers, products, regulations and financial information, and those relationships are often more important than the document itself.
The challenge is that LLMs aren’t designed to inherently understand the interconnected relationships and context that support documents. Left alone, LLMs infer connections from language patterns. Sometimes they’re right, but other times they sound convincing even when they’re completely wrong. That’s not governance; that’s guesswork.
One of the biggest misconceptions in enterprise AI is that giving a model more documents will lead to better decisions. In reality, AI is significantly more reliable when it’s grounded in business relationships rather than trying to infer them.
This is where connected information is essential. Organizations already have trusted systems of record, whether that is an ERP platform, CRM system, financial application or governed repositories. They reflect how their business actually operates. Rather than asking AI to re-create those relationships from scratch, businesses should expose those validated relationships directly.
Think of it as giving AI a map instead of asking it to draw one. If an employee asks a question related to a line of business, for example, the answer shouldn’t depend on the model making educated guesses from thousands of document pages. It should come from validated relationships between contracts, components, suppliers and facilities that already exist within governed business systems.
When AI can reference trusted relationships instead of implied ones, accuracy improves dramatically. Just as importantly, every answer becomes traceable back to the source. That’s a foundation that organizations can audit and trust.
As agents are granted more autonomy, governance can no longer be a static framework. It must evolve alongside the systems it’s designed to oversee.
Unlike human workers, agents don’t get tired, lose focus or stop working at the end of the day. If they make a mistake, they may repeat it again and again before anyone notices. An incorrectly configured agent could expose sensitive information, send inaccurate communications or execute actions that create compliance risks—all at a scale humans simply can’t match.
That’s why governance in the agentic era is about more than securing AI models. Organizations need security controls that move as quickly as their AI systems, ensuring agents only access the information they’re authorized to use and take actions only within clearly defined boundaries. The same governance policies that apply to employees should apply to AI agents.
Technology alone won’t solve this challenge, and organizations need clear ownership over AI agents and the decisions they make.
In many enterprises, the technology department handles governance because it requires stronger security oversight and visibility. Depending on the organization, security and risk teams should define what agents can access and do, while technology teams implement and enforce those controls.
Accountability, however, should remain with the business function deploying the agent. If the finance team introduces an agent to approve invoices or a sales team deploys one to communicate with customers, those owners remain responsible for the outcomes. AI may automate the work, but it doesn’t eliminate accountability.
It’s easy to mistake new AI capabilities for measurable progress, especially as many organizations add AI without asking whether it’s solving a real business problem.
Trust must be prioritized over novelty. Building that trust requires continuously measuring whether AI is producing reliable outcomes, validating its recommendations against trusted business data and refining systems based on real-world feedback.
Trusted AI isn’t about better models. It has always been about better information. Investing in trusted data, connected business context and modern governance reduces risk and creates the foundation that allows AI to deliver on its promise.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
