AI agents can build data workflows faster than some teams can write the ticket. The speed is increasing, and so is the governance problem it creates — as Meta’s March 2026 Sev-1 incident demonstrated when an internal AI agent exposed sensitive user and company data to engineers who shouldn’t have seen it… the exposure lasted two hours before containment.
It wasn’t an isolated event either: Gravitee’s State of AI Agent Security research found that 88% of organizations reported confirmed or suspected AI agent security or privacy incidents within the past year, with firsthand accounts describing agents making API calls under elevated privileges and taking actions they were never authorized to perform.
When a regulator asks which agent produced a given table, under whose permissions, and what each transformation did to the data, the honest answer is usually a pile of logs: timestamps and outputs, but no defensible story tying the agent’s identity, the user’s grants, and every data-prep step to the code that shipped.
From our work building agentic data preparation at Prophecy, we’ve learned that governance controls must sit inside the workflow’s structure from step one.
Why most AI agent workflows fail governance review
Most agentic deployments share the same three governance gaps, and each one alone is enough to sink a compliance review:
- Over-privileged agents: An agent with broad platform credentials can read datasets outside the requesting user’s grants. Unchecked permissions enable risky actions.
- Opaque authorization chains: Auditors can’t tell who authorized what, when, and in what context, because deployments lean on manually managed access lists, shared API keys, and service account credentials that were never designed to carry a per-request accountability trail.
- No approval point: Outputs reach production without a person in between when organizations skip a defined checkpoint. That habit compounds into unauditable production data.
Together, these gaps produce challenges for any governance review. Closing them requires structural controls, which we’ll dive into in the next section.
Four design-time controls when using AI for data
Four design-time controls make AI-generated data workflows auditable:
1. Permission inheritance
The agent operates under the requesting user’s existing access — no elevated privileges or shared service account. In delegated token exchange, the user’s identity stays in the token while the token identifies the agent as the acting party. Shared credentials, static API keys, and user-impersonation tokens each break the accountability chain that effective security governance depends on.
Cloud data platforms like Databricks, Snowflake, or BigQuery bind agent sessions to the querying user’s role so permissions carry through. If an analyst can’t read certain tables, the agent they prompt must block that access too.
2. Step-level visibility
Reviewers should inspect every data preparation step the agent proposes before the platform applies it. Human reviewers should be able to challenge transparent autonomous decisions when necessary. If the agent summarizes a 14-step chain as “done,” or just shows the code generated, then business reviewers can only check the output, and a result can look right while the logic is wrong.
Because SQL fluency varies across analytics teams, a visual representation of the data workflow lets an analyst who knows the business validate transformation logic they couldn’t audit as code, while the platform team reviews the same artifact. That visibility turns AI agents into a self-service capability analysts can trust, and the platform team still has the evidence an auditor will ask for.
3. A human checkpoint before production release
Agents draft under the controls above, and a person approves before release. Emerging standards reinforce this: for high-stakes API calls, a person outside the agent’s own decision loop must actively confirm the action before it executes — the agent cannot approve its own work.
Not every action needs the same scrutiny, so teams can apply a tiered action review:
- Autonomous: Routine, reversible steps run without approval. Flagging them adds friction without safety.
- Notify: Actions are logged for awareness but not blocked. Reviewers can intervene if patterns emerge.
- Approve: Consequential actions, including production release, require sign-off, carrying the action description, agent reasoning, impact assessment, and execution history.
Tiering keeps low-risk work fast while reserving human attention for decisions that warrant it.
4. Change history captured as a byproduct of execution
Every agent action should produce its own record. An audit record should capture the event type, when and where it occurred, its source and outcome, and the identity associated with it. When the agent writes that record as a byproduct of execution, the audit trail exists before anyone asks for it. When it doesn’t, the team reconstructs the trail from remaining telemetry — the same gap that can open a governance review.
“The agent did it” won’t survive an audit. Log history, version control, and other software best practices will. Projects that can’t clear this bar are among those Gartner expects to be canceled as agentic AI matures.
What a governed AI agent workflow looks like
The four controls matter only if the resulting workflow behaves the way governance expects.
Prophecy delivers agentic data preparation that puts these controls into the workflow’s structure; multiple AI agents generate visual data workflows from natural language prompts, so analysts can build and refine transformation logic with speed, independence, and efficiency. Data engineers still perform significant transformation upstream during ETL.
Because these visual workflows run natively on cloud data platforms like Databricks, Snowflake, or BigQuery, your organization retains full control of compute, governance, and security, and the platform continues to enforce permissions and auditing on the same identities the compliance team already governs.
Design AI agent governance before your project starts
The mistake in the sequencing is letting the agent build freely now and adding a review gate later. Design-by-default governance builds proactive rather than reactive measures into the workflow, and for AI, governance is a cross-cutting function throughout risk management. Reactive measures push work into shadow AI, while structural controls enable governance audit readiness from the start.
Ready for better governance?
See Prophecy AI agents in action by booking a demo today.
