One query, two very different checkpoints
| Moment | Runtime governance | Compile-time governance |
|---|---|---|
| Intent | Unchecked | Resolved against a scoped graph |
| Plan | Built freely | Built only from permitted paths |
| Execution | Filtered or refused | Nothing left to refuse |
| Audit record | A blocked attempt | An impossible request |
Seven ranking pages in this category score metadata coverage, lineage, and deployment effort. Not one asks where enforcement happens. Governing AI agents that query enterprise data takes that question as its starting point. Our governance and security hub covers the wider architecture.
The scorecard
Status reflects each vendor's own documentation rather than its press releases, because in this category the two disagree. Directional, not lab numbers.
| Tool | Governs | Enforcement point | Agent-level control | Engine reach |
|---|---|---|---|---|
| Colrows | Data access via the graph | Before the plan exists | Inherent | 16+ engines |
| Databricks Unity Catalog | Data and AI assets | Query time | Beta | Databricks, federation read-only |
| Snowflake Horizon | Data and Cortex agents | Query time | Private preview | Snowflake, Iceberg engines |
| Immuta | Data access | Query time, native pushdown | Private preview | 8 platforms |
| Trust3 AI | Data and AI | Query time | Marketing pages only | 28 documented connectors |
| Collibra | Data and AI registry | Query time, pushed down | Preview | 4 platforms |
| IBM watsonx.data intelligence | Data | Query time, native | Not offered | watsonx engines |
| Atlan | Metadata | Provisioning time | Not offered | Metadata only |
| Alation | AI registry | After the fact | Not offered | Catalog only |
Fix the Context, Not the Model. A well-governed semantic layer that understands business context creates more reliable AI-driven analytics than fine-tuning the model itself. Governance follows the same rule. You do not make an agent safe by watching what it does. You make it safe by shaping what it can construct.
The gap between the press release and the docs
This category has an unusual honesty problem, and it is checkable in an afternoon. We compared what vendors announced with what their own documentation says.
Databricks shipped Unity AI Gateway in June 2026 and ships contextual service policies, which can allow, deny, or require approval on agent actions. Its documentation labels those policies Beta. Attribute-based access control reached general availability in 2026, and row filters and column masks with it, so the data layer is genuinely mature. The agent layer is not yet.
Snowflake announced a Cortex AI Gateway offering identity, policy, and audit at the tool-call level in July 2026, in private preview. Its data governance is strong and long-standing, with row access policies and masking evaluated at query time. Agent-level policy is new.
Immuta issued press releases in mid 2026 describing agentic data access as available. Its own documentation still carried a private preview banner, and the capability is cloud-only. Trust3, which renamed itself from Privacera in March 2026, markets per-agent allowlists, tool-level permissions, and a kill switch. None of those appear in its documentation with a status label or a date.
None of this makes the products bad. The category is simply early. Buy the data governance, and treat the agent governance as a roadmap item you will verify yourself.
The agent inherits the human grant
A second pattern runs through every architecture here. Where agent governance does exist, it inherits the data governance model rather than adding an agent one.
Snowflake Cortex Agents run under the caller's role. Databricks managed MCP authenticates on behalf of the user. Immuta vends an ephemeral role that is the union of user and agent privileges. In none of these does the agent receive a narrower grant than the person who triggered it.
That matters because agents behave differently from people. A human with broad access asks a few questions a day. An agent with the same access can issue hundreds of queries an hour, across tables the person never opened. MCP server auth models either contain that risk or widen it. One documented example makes the risk concrete. Attribute-based policies on a Databricks source table do not reach an AI search index built from that table. The index syncs every row.
The tools, by what they actually control
1. Databricks Unity Catalog - the most complete data layer
Unity Catalog governs data and AI assets together, and its attribute-based access control reached general availability in 2026 alongside row filters and column masks. Databricks AI and BI tools compared maps the wider stack. Governed tags give you the attribute substrate. The agent layer, contextual service policies on the Unity AI Gateway, remains Beta. Watch one documented gap: policies on a source table do not reach a search index built from it.
2. Snowflake Horizon - mature policy, new agent surface
Horizon enforces row access policies and masking at query execution, and those capabilities are long-standing and well documented. See Snowflake AI tools compared for the products above it. Row access policies require Enterprise Edition or higher. The Cortex AI Gateway that adds tool-call level policy for agents entered private preview in July 2026.
3. Immuta - policy that pushes down natively
Immuta writes native policies into Snowflake and Unity Catalog rather than proxying queries, which keeps enforcement where the data lives. Role-based and attribute-based control, row-level security, and masking are all mature. Its agentic data access work vends an ephemeral role, and its own documentation still described that as private preview after the press releases said otherwise.
4. Trust3 AI, formerly Privacera - broadest connector list
Trust3 renamed itself from Privacera in March 2026 and documents 28 connectors, the widest reach in this comparison. It offers dual enforcement, in-query through a plugin and native through policy translation. Treat its agent security claims carefully. Per-agent allowlists, tool-level permissions, and a kill switch appear on marketing pages, without a documentation page or a status label.
5. Collibra and IBM - governance for the catalogue estate
Collibra pushes column masks and row filters down to Snowflake and Unity Catalog rather than enforcing them natively. Its AI work is a registry plus a preview. IBM renamed Knowledge Catalog to watsonx.data intelligence in 2025, and it does enforce natively inside its own query engines. Its separate governance product monitors models rather than blocking queries.
6. Atlan and Alation - metadata, not enforcement
Both belong on a governance shortlist and neither enforces access. Atlan governs at provisioning and request time, and its own documentation describes it as an interface to tools rather than an access control layer. Alation documents and approves after the fact. Buy them for discovery and stewardship, and do not expect either to stop a query. Data catalogues cannot execute AI agents covers that boundary.
What to ask a governance vendor
- Where does the check run? Ask for the point in the query lifecycle, not the feature name.
- Is the agent control GA, and where does it say so? Ask for the documentation page, not the press release.
- Does the agent get a narrower grant than the user? If the answer is no, your blast radius equals your most permissioned analyst.
- Which derived objects escape the policy? Indexes, extracts, caches, and materialised views are where row-level rules quietly stop applying.
- What does the audit record contain? A refusal log is not the same as a reproducible record of what ran. Regulated buyers need the second one.
The fine-grained access control guide covers policy design, and governance as semantics covers why the rules belong in the model rather than beside it.
Where Colrows changes the math (our product)
Colrows moves the check ahead of the plan rather than adding a gate in front of the agent. The compiler resolves a question against a typed semantic graph scoped to the caller. It proves the join path and applies row and column predicates while the query takes shape.
An unauthorised plan therefore never exists, which is a different guarantee from refusing one. The agent also receives a narrower surface than the person, because the scope belongs to the graph rather than to a warehouse role. The audit record holds the exact statement that ran and reproduces on demand, which is what an examiner asks for.
None of that removes the need for a catalogue or a policy engine. It changes what those systems have to catch.
A note on the claims
Status labels come from each vendor's own documentation as of late August 2026. Where a press release and a documentation page disagree, we report the documentation and say that they disagree. We do not quote third-party pricing for vendors that publish none. Colrows sells a competing product, and we wrote the sections above with that disclosed. We review this page quarterly.
Frequently asked questions
What are data governance tools for AI agents?
They are the systems that decide which data an AI agent may reach and what it may do with it. Most are conventional data governance platforms extended to cover agents, so the agent inherits a human permission model. A smaller group tries to govern the agent action itself, deciding whether a planned tool call may run. In 2026 the second group is still pre-release across the board.
Can any tool block an AI agent before it queries data?
Not as a generally available product in August 2026. Databricks ships contextual service policies for agent actions in Beta. Snowflake announced a Cortex AI Gateway with tool-call policy in private preview. Immuta and Trust3 market agent controls that their own documentation does not yet describe as released. A compile-time semantic layer achieves the same outcome differently, by making an unauthorised plan impossible to construct.
Does an AI agent get narrower permissions than a human?
Usually not, and that surprises people. Snowflake Cortex Agents run under the calling role. Databricks managed MCP authenticates on behalf of the user. Immuta vends an ephemeral role that combines user and agent privileges. In each case the agent inherits the human grant rather than a reduced one, so an over-permissioned analyst becomes an over-permissioned agent.
What is the difference between runtime and compile-time governance?
Runtime governance checks the query as it executes, so the plan already exists and only the result is withheld. Compile-time governance applies the rules while the query takes shape, so a plan that violates policy never appears. The practical difference shows up in audit. A runtime system logs a blocked attempt, and a compile-time system has nothing to block.
