Governance beyond security: knowledge, context & ontology on the lakehouse

Summary

The post argues that healthcare AI governance must extend beyond security controls to include knowledge, context, and ontology: security governs access, while semantics determine what data means and whether models can trust it. DEP frames classification tags, model cards, data contracts, and lineage as machine-readable governance artifacts, with Unity Catalog serving as the metadata runtime for agents. Build agents can generate ETL, testing, de-identification, and deployment, while analytic agents answer questions over individual data products; human stewards approve proposals and own accountability. A shared lifecycle certifies the data product and AI track through gates using scores for governance, quality, semantics, and ownership, with certification expiring after relevant changes or failures. The approach applies data-layer ABAC to SQL and vector retrieval, logs agent prompts with lineage, and connects readiness metrics to model economics by enabling smaller models when cataloged data supplies sufficient context.

Takeaways

1. 1

   Classification tags, model cards, data contracts, and lineage are treated as semantic building blocks: concepts, context, shared definitions, and relationships that agents can consume.

2. 2

   AI Certification records governance, quality, semantics, and ownership scores in Unity Catalog; schema changes, contract updates, or failed evaluation suites can revoke certification until checks pass again.

3. 3

   Attribute-Based Access Control applies at the data layer so SQL and vector retrieval inherit the querying user’s grants, while agent prompts are logged with the lineage used to answer them.