Enhancing Agent Governance with DataHub and SecuPi: From Trusted Context to Runtime Control
AI agents moving rapidly into production across financial services, telecommunications, and healthcare are querying enterprise data through service accounts that span Snowflake, Databricks, data lakes, and operational applications. Most organizations building these agents have invested heavily in making them accurate, but few have answered the harder question of how you govern what an agent is allowed to see and do once it can access your data.
The governance challenge for AI agents differs from the one enterprises solved for human users. A human analyst authenticates with their own identity, and access controls follow them. An AI agent typically operates through an over-provisioned service account or non-human identity (NHI), obscuring who initiated the query and why. The end-user’s authorization context (role, purpose, need-to-know constraints) gets lost the moment the agent picks up the request.
Solving this requires two capabilities working together. One is a context layer that understands the data’s meaning, lineage, and ownership. The other is a runtime enforcement layer that preserves identity and applies fine-grained access controls at query time. DataHub and SecuPi address these two halves of the problem.
Context and authorization are separate problems
DataHub operates as the context platform between AI agents and enterprise data. It ingests technical metadata such as schemas, column-level lineage, and data quality signals alongside semantic context such as business definitions, metric logic, ownership, and domain classification from more than 150 data sources. That context is represented as a graph, where entities are nodes and typed relationships are edges, so an agent can reason about not just what a dataset contains but where it came from, who owns it, and whether it’s trustworthy.
When an analytics agent receives a natural language question, it calls DataHub first to plan its approach. DataHub’s MCP-native APIs return the relevant context, including which tables to query, which metric definitions apply, what joins are appropriate, and what quality signals are attached. The agent uses that context to construct its query and route it to the appropriate data platform.
But knowing which table to query and being authorized to see every column in it are different things. A Snowflake Cortex or Databricks Genie agent grounded in DataHub’s context might correctly identify that a customer churn analysis requires joining three tables across two schemas. Whether that agent should see the Social Security numbers, account balances, or health indicators in those tables is a policy question that context alone doesn’t answer.
Preserving identity through the agent layer
SecuPi‘s contribution sits at the runtime boundary. Its Account Brokering capability preserves the end-user’s identity and authorization context behind the agent’s service account, so that when an agent queries data on behalf of a portfolio manager, the access controls that apply are the portfolio manager’s, not the service account’s.
This manifests itself operationally in several ways. An agent querying customer records for a compliance officer should see different fields than the same agent querying the same records for a marketing analyst. Without identity preservation, the agent inherits the broadest permissions of its service account, which in most enterprise deployments means it can see everything the service account can reach.
SecuPi applies fine-grained controls at the field level, dynamically masking, tokenizing, or blocking sensitive data based on the requesting user’s role, purpose, and the data’s classification. DataHub’s governance metadata, including ownership, lineage, and domain context, informs those policy decisions. SecuPi enforces them at query time.
Building this in practice
Data platform teams can implement the integration easily and incrementally.
Connect DataHub to your data estate
Start by connecting DataHub to the data sources your agents will query. DataHub’s ingestion framework supports Snowflake, Databricks, BigQuery, Redshift, PostgreSQL, dbt, Looker, Tableau, Power BI, Kafka, and dozens of other platforms. The initial ingestion captures schemas, column descriptions, lineage, and operational metadata like query frequency and user counts.
For organizations already running DataHub (the open-source project is deployed at more than 3,000 organizations), this foundation is likely in place. The context platform capabilities, specifically Context Intelligence and Context Hub, are available in DataHub Cloud and add the semantic layer that agents need.
Build the semantic context layer
Raw metadata tells an agent that a column called revq3ne exists but not that it represents quarterly revenue for the Northeast region, calculated net of returns, using the finance team’s definition rather than marketing’s.
DataHub’s Context Intelligence capability bootstraps this semantic layer by analyzing query logs, identifying high-signal patterns (multi-table joins, frequently run interactive queries, queries from known expert analysts), and extracting implicit business logic. The platform surfaces conflicting metric definitions, such as two departments calculating “active users” differently, and routes them to subject matter experts for resolution through Context Hub.
Miro‘s Snowflake Cortex agent answered roughly 40% of benchmark questions correctly using Snowflake metadata alone. After layering in DataHub as the context platform, accuracy more than doubled to about 90%.
Define access policies that follow the user, not the agent
With context in place, the governance question shifts from “does the agent have the right business definitions?” to “does this specific user, acting through this agent, have permission to see this specific data?”
SecuPi’s integration consumes DataHub’s governance metadata, including data ownership and lineage, to inform runtime access decisions. The policy model operates on multiple dimensions, covering who the end user is, what their role is, what the purpose of the query is, what sensitivity level the data carries, and what action the agent is attempting.
As a practical example, a financial services firm’s analytics agent, grounded in DataHub’s context, correctly identifies that answering “What is our exposure to commercial real estate in the Northeast?” requires joining loan portfolio data with property valuation tables. SecuPi’s runtime layer checks whether the requesting user is authorized to see individual loan amounts or only aggregated exposure figures, and applies field-level masking accordingly. The agent gets the context it needs to write the right query; the user gets only the data their role permits.
Close the auditability loop
Regulatory environments in financial services, healthcare, and telecommunications require complete audit trails. When an AI agent makes a data access decision, auditors need to trace the chain of who asked the question, what context informed the agent’s query plan, what data the agent accessed, what the user actually saw, and what was masked or blocked.
DataHub’s context graph provides the first half of that chain, documenting which business definitions, lineage paths, and quality signals informed the agent’s reasoning. SecuPi provides the second half, logging every runtime access decision, every masking action, and every policy enforcement event with the preserved end-user identity attached.
Together, these create what amounts to a governed corridor. The agent operates with full business context but within boundaries that are auditable, explainable, and tied to the actual human who initiated the request.
Where this architecture sits in the stack
The reference architecture has three layers. The bottom layer is the enterprise data estate, spanning warehouses, lakehouses, operational databases, SaaS applications, streaming platforms, and APIs. DataHub sits above that as the context layer, ingesting metadata and semantic knowledge from across those sources and delivering it to agents through MCP, Context Kit, APIs, and SDKs. SecuPi operates at the runtime boundary between the agent and the data, enforcing access controls as queries execute.
Agents from any framework can consume this stack. DataHub’s MCP-native integration supports Snowflake Cortex, Databricks Genie, Claude, Cursor, LangChain, Google ADK, and CrewAI, as well as custom enterprise agents built on LangGraph or other frameworks. SecuPi’s enforcement applies regardless of which agent framework initiates the query.
This vendor-neutral posture matters because most enterprises are not pursuing a single-agent strategy. As Shirshanka Das, DataHub’s co-founder and CTO, has noted, most customers have “at least two, sometimes three agents that they use to talk to their data,” including platform-provided agents like Cortex or Genie alongside custom-built agents and general-purpose tools like Claude. A governance architecture that only works with one agent framework or one data platform will leave gaps.
Getting started
Teams evaluating this integration pattern can begin with a single high-value use case, ideally one where accuracy and access control both matter. An analytics agent serving a regulated business unit (risk reporting, customer analytics in financial services, claims processing in insurance) is a strong candidate because it creates immediate demand for both trusted context and governed access.
Connect DataHub to the data sources that the use case requires. Build the semantic context for the relevant domain. Define access policies in SecuPi that reflect your existing authorization model. Then measure whether the agent’s answers are more accurate with DataHub’s context (the Miro case study suggests roughly 2x improvement is achievable), and whether the access controls hold under real query patterns.
From there, extending to additional agents and data domains follows the same pattern. The context you build for one agent is shared infrastructure; every subsequent agent benefits without a separate context engineering project.
To learn more about how DataHub and SecuPi partner to extend AI governance into runtime data access control, join our joint webinar on September 22: From Data Governance to Runtime Control: Governing What AI Agents Can Access, See and Do.
Stephen Goldbaum is Field CTO for Financial Services at DataHub. The DataHub and SecuPi joint webinar, “From Data Governance to Runtime Control: Governing What AI Agents Can Access, See and Do,” takes place September 22, 2026 at 11:00 AM ET.
