The Trust Layer Behind AI: Sudheer Muppidi on Rethinking Enterprise Data Governance

Sudheer Muppidi: When you have worked with enterprise data for a long time, you tend to look beyond what an application can do and ask what information is making that possible.

Large organizations may have decades of data distributed across operational systems, databases, cloud platforms, applications and documents. Much of that information was created for specific business purposes. It was not necessarily designed with AI in mind.

That matters when organizations begin connecting AI to those environments.

Before relying on an AI-enabled process, I would want to understand where its information is coming from, whether it is reliable, who owns it and whether there are restrictions around how it should be used.

The model is obviously important, but organizations also need confidence in the information being provided to it.

As AI moves deeper into business operations, I think the conversation will increasingly shift from simply asking what a model can do to understanding the data that makes those capabilities possible.

Sudheer Muppidi: One of the most useful lessons was realizing that very different industries often struggle with similar underlying data problems.

The business language changes. The regulations change. The applications certainly change. But questions around ownership, Data Quality, duplication, sensitive information, business definitions and lineage appear again and again.

What changes is the consequence.

In environments dealing with sensitive or regulated information, accuracy and appropriate access become especially important. A data problem is not always just a technical issue. It can affect a business process, a customer interaction, a regulatory obligation or the confidence people have in a decision.

That experience changed how I approach Data Governance. I don't start with the assumption that governance means creating more documentation. I start with the problem the organization is trying to solve.

Can people identify the right data? Do they understand what it means? Do they know who is responsible for it? Can they determine where it originated?

If governance helps answer those questions, it becomes part of how the organization operates rather than a separate administrative exercise.

Sudheer Muppidi: AI tends to cross boundaries that organizations have traditionally maintained between data functions.

Consider an AI-enabled business process that needs information from multiple enterprise applications. MDM may be needed to establish a consistent view of a customer or another business entity. Data Quality helps determine whether important attributes are reliable. Metadata provides business and technical context. Lineage helps explain how information moved and changed. Privacy controls become important when sensitive information is involved.

Those capabilities may belong to different teams, but the application consuming the information experiences them as one connected data environment.

That is why I think AI is encouraging a more integrated approach to enterprise data management.

The conversation is becoming less about managing governance, quality, MDM, metadata and privacy independently and more about how those capabilities work together to establish confidence in the data being used.

Sudheer Muppidi: A privacy policy is important, but organizations also need visibility into the actual data environment.

In enterprise environments, sensitive information can exist in many places. You may find it in databases and structured systems, but also in files, documents, cloud environments and other unstructured sources.

The practical challenge is connecting policy with what is actually present in those systems.

If sensitive information is discovered, the next questions become important. What type of information is it? Who owns it? Who should have access to it? Why is it being retained? Where is it moving?

That experience taught me that privacy governance has to begin with understanding the data itself.

AI adds another dimension because an intelligent application may be capable of accessing and combining information from several sources. Organizations therefore need to think not only about whether information is technically accessible, but whether using it is appropriate for that particular purpose.

That distinction becomes increasingly important as AI is integrated into enterprise workflows.

Sudheer Muppidi: Identity is one of the recurring challenges.

Consider a large enterprise where a customer, supplier, product or other business entity exists in several systems. Those systems may contain different identifiers, attributes or versions of the same information.

The practical challenge is determining which records belong together and what information should be considered trusted when systems disagree.

MDM addresses that through capabilities such as matching, merging, survivorship, hierarchy management and stewardship.

Now consider the same problem from the perspective of an AI agent that needs information from multiple applications. The agent still needs reliable context about the entity it is working with.

That's why I don't view MDM as something AI makes obsolete. In many situations, AI actually makes the underlying identity problem more visible.

As intelligent systems become more connected across the enterprise, getting that identity layer right stops being a data hygiene issue and starts being a precondition for trusting what the AI does with it.

Sudheer Muppidi: It was less about one particular moment and more about seeing the amount of manual effort required to govern increasingly complex data environments.

There is a lot of work involved in discovering assets, classifying information, maintaining metadata, understanding relationships, monitoring Data Quality and connecting technical information with business meaning.

As organizations add more systems, cloud platforms and data sources, that work becomes harder to sustain manually.

That led me to become interested in how AI could assist with governance itself.

For example, AI can potentially support classification, metadata enrichment, relationship discovery and the identification of unusual Data Quality patterns. It can also help make technical information easier for business users to understand.

But I think there has to be a balance. Automation can help with scale, while people still provide business context and accountability.

That intersection between intelligent automation and human governance is one of the areas I find most interesting.

Sudheer Muppidi: For me, the difference is whether the idea can eventually address a real problem in a real operating environment.

A solution can be technically sophisticated, but enterprises have constraints. There are existing applications, security requirements, privacy considerations, integration dependencies, operational processes and data that is rarely as clean as we would like it to be.

When I review technical work, I look at whether the problem is clearly defined, whether the proposed approach actually addresses that problem and whether the conclusions are supported. My industry experience naturally makes me think one step further about implementation.

I also look at the assumptions being made about the data and the environment around it. If those assumptions don't hold in practice, even a strong technical idea can become difficult to apply.

At the same time, I don't think every research idea needs to be immediately deployable. Research should push boundaries. What interests me most is when a new idea addresses a meaningful problem in a way that could eventually translate into practical value.

Sudheer Muppidi: One recurring mistake is treating governance primarily as a technology implementation.

An organization can implement a data catalog, define business terms, build Data Quality dashboards and establish governance workflows. Those are useful capabilities, but technology alone does not create accountability.

The difficult part is what happens when an actual data problem appears.

If a critical Data Quality rule fails, who is responsible for investigating it? If sensitive information is discovered in an unexpected location, what process follows? If two systems disagree about an important business entity, who determines which information should be trusted?

Those situations reveal whether governance is really operating.

I have learned to look at governance less in terms of how much documentation exists and more in terms of how effectively an organization can respond when something about its data needs attention.

Technology enables that process, but ownership and accountability are what make it work.

Sudheer Muppidi: I think organizations need to distinguish between demonstrating that AI can perform a task and being confident enough to rely on it in an operational environment.

A successful pilot can show that a model is capable. Operational use introduces a different set of questions.

Is the information feeding the system reliable enough for that purpose? Do we understand its origin? Are responsibilities clear when something goes wrong? Can an important outcome be traced and reviewed?

These questions become more significant when AI is used in environments such as government, healthcare, financial services, insurance and other data-intensive sectors.

The United States has significant opportunities to apply AI across these areas, but moving from experimentation to dependable use requires more than model performance. Organizations also need appropriate controls, traceability and accountability around how information is being used.

That is where I see the experience I have built in enterprise data becoming increasingly relevant. The objective is not to put unnecessary controls around AI. It is to create enough confidence in the underlying information and processes that organizations can use AI responsibly when the outcome matters.

Sudheer Muppidi: I think the next challenge will be moving from governing what data an AI system can access to governing what that system can actually do with the data.

That becomes particularly important with agentic AI.

An intelligent agent may retrieve information from several applications, initiate a workflow, communicate with another system or perform an action. Once that happens, organizations have a different set of governance questions.

What information is the agent permitted to access? For what purpose? Which actions can it perform independently? When should a person be involved? Can the organization reconstruct what happened if a decision or action is questioned later?

The regulatory environment will vary from one country to another, but those basic questions are relevant globally.

For years, Data Governance has focused on helping organizations understand, manage and trust their information. I think the next phase will extend those principles to the intelligent systems using that information.

The challenge will no longer be only about trusting the data. It will also be about establishing appropriate boundaries and accountability around what AI is permitted to do with it.