A quiet consensus has formed in enterprise data. Exporting your most sensitive records to a separate AI environment, training there, and copying results back is slow, expensive, and hard to govern. This week, a major warehouse vendor launched in-platform Python compute and illustrated the problem with a customer whose data scientists had been exporting billions of call records and network events to external clusters, a process that was costly and created data sovereignty risk.
We agree with the diagnosis. Every copy of data is a new attack surface, a new governance gap, and a new bill. The fix is to bring AI to the data, not the other way around.
But "bring AI to the data" has a hidden clause. Which data, running where, controlled by whom?
The governance gap is about enforcement, not policy
Agents are spreading faster than controls. In OneTrust's new 2026 survey, 87% of organizations encourage AI agent use, but only 47% say that use is backed by clear governance. Delinea's research is sharper still. Nearly every IT and security leader, 99.7%, says they have a formal policy on what data AI agents may access. Only about 51% check that access against the policy in real time.
In other words, the rules exist. Enforcing them while an agent is working is the hard part. And enforcement is far easier when the data, the access controls and the AI workload sit in one governed environment rather than spread across export jobs and side clusters.
Where "in-platform" can go wrong
There are two ways to bring AI to the data.
- Bring it into a vendor's platform. Your data, your models and your agents all move into one proprietary stack, often on one cloud. Governance improves on day one. Over time, your AI strategy inherits that vendor's pricing, roadmap and deployment limits.
- Bring it to wherever your data already lives. The governed data platform runs in your data center, your sovereign or private cloud, or a public cloud of your choice. AI workloads run beside it. Governance improves without handing over control.
The second path matters more as costs and rules shift. Gartner warned this week that compute and storage will stay scarce and expensive for the near future. Europe is tightening sovereignty and portability rules. An AI architecture that only works in one place is a bet that neither will change.
Four tests for a governed AI data platform
- Zero-copy by default. Can models and agents query governed data in place, with no export step?
- One security model. Do the same row, column and role policies apply to a human analyst, a dashboard and an agent?
- Real-time enforcement and audit. Can you answer what an agent accessed and when, not just what it was allowed to access?
- Deployment freedom. Can the whole stack run on-premises, in a sovereign cloud, and in public cloud, without a rewrite?
Most platforms now pass the first test. Fewer pass all four.
The bottom line
AI belongs next to your data. Your data belongs in an environment you control, at a cost you can predict, in a location you choose. Yellowbrick's view is that you shouldn't have to pick between governed AI and that kind of freedom.