By Jon W. Hansen, FCIPS | Procurement Insights · November 2026
This week, Palanisamy Ramasamy, founder and CEO of LuMay AI, posted a sharp warning on LinkedIn: your company may have excellent data governance, and your AI agents can still create a serious incident.
His central point is right, and it matters. AI agents do not just access information. They interpret it, make decisions, call tools and trigger actions. A person may be allowed to view invoices, but that does not mean an AI agent should be allowed to approve payments. As he put it, the biggest AI governance risk is not always bad data. It is a system taking an unauthorized action using good data.
I agree with all of that. Where I differ is with the framing that came with it, in the title of his infographic: how data governance evolves into AI governance.
Graphic: Palanisamy Ramasamy, Founder and CEO, LuMay AI, “How Data Governance Evolves Into AI Governance,” shared on LinkedIn, November 2026. https://lnkd.in/p/gB8aq9Hk
Why one word matters
To be fair to the graphic, it does not claim that data governance is enough on its own. Between data governance and AI governance it places a transformation layer: human oversight, policy, risk, accountability and monitoring.
But the word “evolves” carries an idea that many executives will take away from it: that AI governance grows out of data governance, so an organization with mature data governance is most of the way there. That is the assumption I believe is the greatest threat to AI success.
Data governance does not become AI governance. It remains one strand within it.
Process-model right, real-world wrong
Even accurate, secure and properly governed data can be process-model right but real-world wrong.
In 1998, a services provider managing maintenance, repair and operations procurement for Canada’s Department of National Defence was achieving 51% next-day delivery against a contract that required 90%. Every record was accurate. The policy told technicians to order parts after each service call. The purchase orders were correct. The data, by any data governance standard, was sound.
None of it showed what was actually happening. Technicians were holding their part orders until four in the afternoon, because their performance was measured on how many calls they answered. The orders reached suppliers too late for next-day delivery, and couriers, customs and finance were all affected downstream.
Now imagine an AI agent in that operation, with perfect data governance and perfectly defined action boundaries. It would have read every record correctly, stayed entirely within its authority, and processed the four o’clock orders faster. It would have automated the problem.
That is the gap the data cannot close. If the data does not capture shadow functions, conflicting incentives, informal handoffs, external agents or workarounds, an AI agent can interpret the available information correctly, act entirely within its authorized boundaries, and still produce the wrong operating outcome.
Change management and enforced compliance with a system believed to be right is even more dangerous! When the system is wrong about how the operation works, pushing people to comply with it does not fix the gap. It drives the workarounds that were keeping the operation running further out of sight, and locks the wrong picture in place. I wrote about why in October: AI Has Not Created a Change Management Problem. It Has Recycled One.
A fourth distinction
Palanisamy’s post sets out three distinctions:
Data access is not action authorization.
Data quality is not AI reliability.
Compliance documentation is not runtime governance.
All three hold. I would add a fourth, and it comes before the others:
Accurate data is not operating reality. The records can be correct while the operation they describe works differently.
The first three govern what an agent may see and do. The fourth asks whether the picture the agent works from matches how the operation actually runs. Get the first three right and miss the fourth, and you have a well-governed agent acting on the wrong operation.
Where AI governance has to begin
AI governance therefore has to begin before runtime permissions and execution logs.
The enterprise starts with the outcome its operation is producing now, and traces backward from it to identify the agents, decisions, incentives, dependencies, shadow functions and workarounds that are collectively producing that outcome. People and systems, inside the organization and outside it, all count as agents.
Only after that traceback reveals how the operation actually works can the enterprise answer three questions:
Is the proposed outcome achievable in the operation as it really is, not as it is documented?
What may the AI agent do, on its own, and where may it only advise?
When should it hold or redirect an action, and when should it engage a person?
The last question is the Firm Fence: an action is held when its outcome leaves the expected range, when it would exceed its authority, or when new evidence reveals a strand nobody declared.
Three kinds of governance, in the right order
Data governance governs the information. AI governance governs the agent. Phase 0™ establishes whether the operating understanding behind both reflects reality.
Data governance is necessary. It is not the foundation it is often taken to be. The foundation is an accurate understanding of how the operation works, and that does not come from the data. It comes from tracing the operation.
An organization that believes its data governance has evolved into AI governance has skipped that step. Its agents will be grounded in information that is accurate, secure and well governed, and they may still be grounded in the wrong operation.
Truth Is Believing. Accuracy Is Knowing. Outcome Is Proof.™
-30-
References
Palanisamy Ramasamy, LuMay AI, LinkedIn post and infographic, “How Data Governance Evolves Into AI Governance,” November 2026. https://lnkd.in/p/gB8aq9Hk
The Greatest Threat to Your AI Success Is the Following Statement: Data Governance Evolves Into AI Governance
Posted on November 2, 2026
0
By Jon W. Hansen, FCIPS | Procurement Insights · November 2026
This week, Palanisamy Ramasamy, founder and CEO of LuMay AI, posted a sharp warning on LinkedIn: your company may have excellent data governance, and your AI agents can still create a serious incident.
His central point is right, and it matters. AI agents do not just access information. They interpret it, make decisions, call tools and trigger actions. A person may be allowed to view invoices, but that does not mean an AI agent should be allowed to approve payments. As he put it, the biggest AI governance risk is not always bad data. It is a system taking an unauthorized action using good data.
I agree with all of that. Where I differ is with the framing that came with it, in the title of his infographic: how data governance evolves into AI governance.
Why one word matters
To be fair to the graphic, it does not claim that data governance is enough on its own. Between data governance and AI governance it places a transformation layer: human oversight, policy, risk, accountability and monitoring.
But the word “evolves” carries an idea that many executives will take away from it: that AI governance grows out of data governance, so an organization with mature data governance is most of the way there. That is the assumption I believe is the greatest threat to AI success.
Data governance does not become AI governance. It remains one strand within it.
Process-model right, real-world wrong
Even accurate, secure and properly governed data can be process-model right but real-world wrong.
In 1998, a services provider managing maintenance, repair and operations procurement for Canada’s Department of National Defence was achieving 51% next-day delivery against a contract that required 90%. Every record was accurate. The policy told technicians to order parts after each service call. The purchase orders were correct. The data, by any data governance standard, was sound.
None of it showed what was actually happening. Technicians were holding their part orders until four in the afternoon, because their performance was measured on how many calls they answered. The orders reached suppliers too late for next-day delivery, and couriers, customs and finance were all affected downstream.
Now imagine an AI agent in that operation, with perfect data governance and perfectly defined action boundaries. It would have read every record correctly, stayed entirely within its authority, and processed the four o’clock orders faster. It would have automated the problem.
That is the gap the data cannot close. If the data does not capture shadow functions, conflicting incentives, informal handoffs, external agents or workarounds, an AI agent can interpret the available information correctly, act entirely within its authorized boundaries, and still produce the wrong operating outcome.
Change management and enforced compliance with a system believed to be right is even more dangerous! When the system is wrong about how the operation works, pushing people to comply with it does not fix the gap. It drives the workarounds that were keeping the operation running further out of sight, and locks the wrong picture in place. I wrote about why in October: AI Has Not Created a Change Management Problem. It Has Recycled One.
A fourth distinction
Palanisamy’s post sets out three distinctions:
All three hold. I would add a fourth, and it comes before the others:
The first three govern what an agent may see and do. The fourth asks whether the picture the agent works from matches how the operation actually runs. Get the first three right and miss the fourth, and you have a well-governed agent acting on the wrong operation.
Where AI governance has to begin
AI governance therefore has to begin before runtime permissions and execution logs.
The enterprise starts with the outcome its operation is producing now, and traces backward from it to identify the agents, decisions, incentives, dependencies, shadow functions and workarounds that are collectively producing that outcome. People and systems, inside the organization and outside it, all count as agents.
Only after that traceback reveals how the operation actually works can the enterprise answer three questions:
The last question is the Firm Fence: an action is held when its outcome leaves the expected range, when it would exceed its authority, or when new evidence reveals a strand nobody declared.
Three kinds of governance, in the right order
Data governance governs the information. AI governance governs the agent. Phase 0™ establishes whether the operating understanding behind both reflects reality.
Data governance is necessary. It is not the foundation it is often taken to be. The foundation is an accurate understanding of how the operation works, and that does not come from the data. It comes from tracing the operation.
An organization that believes its data governance has evolved into AI governance has skipped that step. Its agents will be grounded in information that is accurate, secure and well governed, and they may still be grounded in the wrong operation.
Truth Is Believing. Accuracy Is Knowing. Outcome Is Proof.™
-30-
References
Share this:
Like this:
Related