Your AI project is not
blocked on the model
Almost every stalled AI project we are called into has a working prototype. What it does not have is anyone willing to sign off on letting it near production data.
What the stall actually looks like
Somebody built a prototype in a fortnight. It worked well enough that the room got excited. Then it went to whoever owns risk, and it has been there ever since.
The questions that came back were not about the model. They were about which tables it read, whether any of them contain personal data, what happens if it repeats something it should not have seen, and who would know if it did. Nobody could answer those quickly, so the project is now waiting on an answer nobody is resourced to produce.
Why the answers are hard to give
In most organisations, access control lives in the tools rather than under them. The warehouse has one set of permissions, the BI tool has another, the notebook a data scientist works in has effectively none, and a copy of last quarter's extract is sitting in a shared drive that nobody has audited since it was created.
That arrangement survives as long as the only things reading data are people, because people can be told what not to do and mostly comply. An agent cannot be told. It reads what its credentials permit, at machine speed, and it will happily summarise a column that a human would have known to leave alone.
The three things that unblock it
First, lineage on every hop. Not a diagram somebody drew, but a record generated by the pipeline itself, showing where a field came from and everything downstream that depends on it. When the question is whether a model touched anything sensitive, this is what answers it in minutes instead of weeks.
Second, enforcement in the query path rather than in the interface. If a column is masked because of who is asking, that mask has to apply to the dashboard, the export, the API call and the agent equally. A rule that only exists in the reporting tool is not a rule, it is a habit.
Third, agents onboarded the way people are. An agent gets its own identity, its own scope, and its own audit trail. When somebody asks what it has been reading, the answer is a query, not an investigation.
What this does to the timeline
The reflex is to treat governance as the thing that delays the AI work. In practice it is the thing that lets the AI work ship at all, because the sign-off it is waiting on is a governance sign-off wearing a different hat.
The order that works is to get the platform answering those questions first, then let the prototype through. Teams that do it the other way round tend to build the prototype twice.
Common questions
Can we not just restrict the agent to a curated dataset? You can, and it is a reasonable first step. It stops working the moment somebody wants the agent to answer a question the curated set does not cover, which is usually within the first month. Curated extracts also age badly, because nothing tells you when the source changed underneath them.
Does this mean the AI work waits for a full governance programme? No, and it should not. The scope that matters is the data the agent will actually touch. Getting lineage, masking and identity right for that slice is weeks of work, not a multi-year programme.