Securing Agentic AI: Why Data Governance is the New Perimeter

securing agentic ai

South Africa, May 18, 2026

Why data governance is the new perimeter 

CIOs are being asked to scale AI quickly — without losing control of security, compliance, or cost. As AI moves from “answering questions” to acting through agents, the goal is to let it move fast inside clear guardrails. That’s where data governance comes in: it’s the control plane that decides what an agent can see, what it can do, and what it can change. 

What CIOs are reporting: AI ambition is outpacing governance 

The recently released Logicalis' CIO Report captures the gap: AI investment and expectations are rising, while governance is struggling to keep pace. 

  • Investment is accelerating: 94% report higher AI spend, yet more than half say adoption is moving too fast. 
  • Visibility is limited: only 37% say they have full oversight of AI tools used across the organisation. 
  • Risk is rising: 57% say employees are putting data security at risk through AI use. 

Agentic AI raises the stakes. When AI can retrieve information, invoke tools, and make changes in production systems, even small governance gaps become material risk. 

In our latest collaboration with IDC, IDC projects more than 1 billion AI agents by 2029, executing roughly 217 billion actions a day. At that scale, manual approvals and after-the-fact reviews won’t keep up, so governance needs to be embedded from day one. Here's what IDC recommend: 

Make governance the control plane for agents 

Agent governance is policy enforcement where AI runs identity, data access, and orchestration. IDC flags it as a top scaling concern because agents can act on systems and data, not just generate content.  

Govern “data in use,” not only “data at rest.” Beyond classification and retention, control retrieval, tool use, and change authority, anchored in enterprise identity, least privilege, and audit trails. 

Reduce shadow AI by making the secure path the easiest path 

Shadow AI already exists in unsanctioned tools and quick automations using corporate data without consistent controls. Don’t only block it — provide approved patterns with enterprise identity, logging, and DLP/data loss protections so teams stay on the governed path. 

Build your data architecture that enforces governance by default 

Architecture is where governance becomes real. Don't bolt controls on later — design the platform so policy is enforced by default across data and systems, even when platforms are fragmented. 

IDC's guidance is simple: use single-agent solutions for clear, bounded tasks; shift to multi-agent systems as workflows become interdependent. Standardise guardrails so teams can scale quickly without reinventing controls. 

The key takeaways from IDC: three governance moves to scale agentic AI 

  1. Set clear agent permissions (control plane): decide what agents can retrieve, what tools they can call, and what they can change—based on risk and compliance. 
  2. Make governed AI the default (reduce shadow AI): offer approved models and connectors with enterprise identity, logging, and DLP, so teams don't need to go off-platform. 
  3. Standardise the patterns (scale guardrails): use repeatable reference architectures for single- and multi-agent work so controls stay consistent and auditable. 

Conclusion: Secure AI starts with data governance 

Bottom line: you can scale agentic AI fast and stay in control—if governance sets the rules for what agents can see, do, and change. Make the governed option the default and standardise patterns so each rollout gets easier. If IDC is right, 1 billion agents and 217 billion actions a day by 2029—automated guardrails are the only way to keep up. 

Read the full research paper here!

Further reading 

Topic

Related Insights