A quarterly access review is a control. It is not a control over something that queries a million times a day.
governance for agents
Your governance assumes a human is reading
Every control you built assumes a person at the other end. Agents query at machine speed and machine volume.
Every governance framework built in the last decade rests on one assumption nobody wrote down: that the thing consuming the data is a person.
That assumption is now false in most enterprises, and nothing downstream of it has been revisited.
What the assumption bought you
Human consumption is slow, intermittent, and self-limiting. A person can only read so many rows, asks for access when they need it, and stops when the answer looks wrong. Almost every control you own is calibrated to that rhythm — quarterly access reviews, sampled quality checks, an approval queue somebody works through on a Tuesday.
None of those properties survive an agent. It queries continuously, at volume, without a sense of when an answer looks wrong, and it does not stop to ask.
Why this is a measurement problem, not a policy problem
The instinct is to write agent-specific policy. That is necessary and it is not sufficient, because the gap is not that nobody said what should happen. The gap is that nothing observes what did.
A person is, among other things, a detector. They notice that the summary contradicts the source, that a total looks off by an order of magnitude, that the citation does not say what the sentence claims. Remove them from the loop and you have removed a control you never had to fund, document, or name.
The three controls that do transfer
An agent should be able to reach the data its task requires and nothing adjacent to it. That requires your lineage to be queryable at request time, not readable in a wiki.
Why: Unscoped retrieval is not only a privacy exposure. It is a quality problem — more irrelevant context is measurably worse than less, and the failure it produces looks like a confident answer.
Pick the two or three ways it can be wrong that would actually cost you, build a detector for each, and run it continuously against held-out cases.
Why: You already do this for latency and error codes. A wrong-but-well-formatted answer returns a 200 and appears nowhere in your dashboards.
Write down the failure rate at which the agent gets switched off, and get it agreed while nobody knows what the rate is.
Why: Set afterwards, the threshold is set to whatever you measured. Everyone does this, and nobody means to.
Where the human-centric stack is still right
For data at rest, it is not wrong at all. Lineage, classification, retention and access are the same problems they always were, and the decade of work that went into them holds.
What does not hold is the inference that because the data is governed, its use is. Those were the same activity when a person sat between them. They are two activities now, and only one of them has a budget.
Governing the data was never the goal. It was a proxy for governing what got done with it, and the proxy just broke.
Which of your controls would still function if the thing on the other side never got tired, never got suspicious, and never stopped?
Every figure here describes something measured and committed. See the measurements · read the method