As organizations rapidly adopt generative AI, many are discovering they already have a governance problem. In "Governing AI in the Cloud: A Practical Guide for Architects", Dave Ward argues that "Shadow AI", which is the use of unapproved AI tools, plugins, copilots, and experimental applications, has quietly expanded enterprise attack surfaces and introduced new data governance risks. The challenge for architects is not whether AI is being used, but how to regain visibility and control without stifling innovation.
Ward recommends starting with discovery. Organizations should inventory AI usage across their environments using observability tools, cloud access security brokers (CASBs), service mesh telemetry, and API monitoring. However, visibility alone is insufficient. Effective governance requires enforcement mechanisms embedded within the platform itself, enabling organizations to understand not only where AI services are being used, but also what data is flowing into them.
A central recommendation is to classify data at the time of creation rather than attempt to retrofit controls later. By integrating data classification with identity and access management (IAM), architects can ensure that sensitive information is automatically governed before reaching AI services. Policy-as-code approaches, including tools such as Open Policy Agent (OPA), then provide a scalable mechanism for enforcing organizational rules consistently across cloud environments.
The article also emphasizes that governance is fundamentally an organizational challenge. Success depends on aligning security, engineering, product, and platform teams around clear ownership models and automated workflows. Manual approval processes rarely scale; instead, governance should be treated as a platform capability that combines discovery, classification, policy enforcement, and observability. For architects, the key takeaway is that AI governance must become part of the software delivery and cloud operating model, rather than a separate compliance exercise.
This content is a short summary of a recent InfoQ article by Dave Ward, "Governing AI in the Cloud: A Practical Guide for Architects", which is part of the "Securing the AI Stack: from Model to Production" article series.
To get notifications when InfoQ publishes content
on these topics, follow "AI, ML & Data Engineering", "architecture and design", and "Artificial Intelligence" on InfoQ.
InfoQ Online Certification Programs covering AI Engineering, AI Security, and Architecture
A lot of this month's reading comes down to a decision you have to make and defend, whether that's how to govern AI in production, when to move an agent from prototype to production, or how AI changes the architecture you commit to.
InfoQ's Online Certification Program cohorts give senior engineers and architects a peer group from other companies with which to work through those kinds of decisions, facilitated by senior practitioners.
Upcoming cohorts include:
- AI Engineering with Hien Luu, author of MLOps with Ray and QCon program committee chair. RAG and context pipelines, agents, evals, and reliability for production AI systems. Starts July 25, 2026, Saturdays 9:00 PDT.
- AI Security & Privacy Engineering with Katharine Jarmul, author of O'Reilly's Practical Data Privacy. Sensitive data handling, threat modeling and red teaming, controls and sandboxes, governance and auditing. Starts August 26, 2026, Wednesdays 2:00 PM CEST.
- Architecture with Luca Mezzalira, Principal Solutions Architect. The sociotechnical side of architecture. Trade-offs and communication, decentralized decision-making, platform engineering, and the AI architecture decisions you're now being asked to own. Three intakes are open, starting August 13, September 14, and October 16.
Each certification cohort ends with a capstone article, the best of which gets published on InfoQ. See all cohorts and dates.
Live online sessions, four hours a week over five weeks. $1,470 per cohort.
Missed a newsletter? You can find all of the
previous issues
on InfoQ.
Sponsored
|
|
AI agents are increasingly operating in production environments with valid credentials and machine-speed autonomy, creating new recovery challenges for cloud and platform teams. This practical guide explores how AI-driven mistakes and attacks can lead to data loss, why traditional backup approaches often fail, and how to detect and recover from incidents more effectively. Learn six actionable checks to identify recovery gaps, scope restores precisely, and build resilience before an AI-driven incident becomes a postmortem.
Read “Report: How to Recover from AI Agent Incidents”, sponsored by Eon
|
|
|
