Design an AI governance workflow in Atlan to register and approve AI models and agents before production.

Introduction

Enterprises are moving AI from pilots to production: chat assistants over internal documents, agents that query warehouses, and machine learning models that score customers. Regulators and boards are asking the same questions each time: what data does this model use, who approved it, is personal data involved, and what happens if it goes wrong? The EU AI Act, sector regulators and internal risk teams all want evidence, not promises.

Atlan, the active metadata and data governance platform, already knows a lot about an organisation's data: tables, columns, lineage, owners, classifications and quality checks. It has extended that into AI governance, letting teams register AI assets and link them to the data they use. The question asks us to design an AI governance workflow in Atlan to register and approve AI models and agents before they reach production.

Step 1

Clarify Questions (3 minutes)

• Which AI assets are in scope: classic ML models, LLM applications, or autonomous agents?

• Why it matters: Agents that take actions carry different risks from a churn model.
• Hypothetical answer: All three, but start with LLM applications and agents, the fastest-growing category.
• Impact: The workflow must capture prompts, tools, data sources and model providers, not only training data.

• Who are the customers we design for?

• Hypothetical answer: Large regulated enterprises (banking, insurance, healthcare) that already use Atlan for data cataloguing.
• Impact: Approval workflows, audit trails and role-based access are essential.

• Where do AI builders work today?

• Hypothetical answer: In notebooks, Git, MLOps platforms (Databricks, SageMaker, Vertex AI) and agent frameworks; very few open Atlan daily.
• Impact: The workflow must start where builders already are, through integrations and APIs.

• What does "approval" mean in this company?

• Hypothetical answer: A risk tiering, review by data owners for data access, review by legal or risk for high-risk use cases, and sign-off before production.
• Impact: We need configurable, tier-based approval paths.

Propose the Goal

Make it the default path, and the fastest one, for an AI builder to get a model or agent approved for production, while giving risk teams a complete, auditable view of every AI asset and the data behind it.

Define the Scope

Registration, risk tiering, data-access review, approval and monitoring hand-off for LLM applications and agents. Model training pipelines and runtime guardrails (like prompt filtering) are out of scope.