Define Your Data Before You Deploy an Agent

The Decision in Front of You

Once an organization decides to deploy an agent on its own data, the technical team faces a design choice. The agent can read source systems and document stores directly, with the meaning of the data explained in prompts. Or the company can put a semantic model between the agent and the data, a maintained, machine-readable description of what each piece of data means, where it came from, how trustworthy it is, and who may use it.

The first path produces a demo in days. Building the model takes weeks per domain before the first answer. This paper argues for the second path wherever a wrong answer carries a financial, legal, or customer cost.

The stakes are already visible in survey data. McKinsey's 2025 global survey found inaccuracy was the AI risk organizations most often experienced, with nearly a third of respondents reporting consequences from it ⁹. Informatica's 2026 survey of 600 data leaders found half named data quality as the top challenge in deploying agentic AI ¹⁰. Informatica sells data management software, so read that figure with its source in mind.

What's Happening

Standards treat confident wrong answers as a named risk

NIST's AI Risk Management Framework 1.0 (NIST AI 100-1), released in January 2023, organizes AI risk work into four functions: Govern, Map, Measure, and Manage ¹. NIST notes the framework is now being revised ¹. Its Generative AI Profile (NIST AI 600-1), published in July 2024, lists twelve risks specific to generative AI ². One is confabulation, which NIST defines as systems that "generate and confidently present erroneous or false content" ².

The profile's suggested actions point at data definition. They include documenting the origin and history of data (GV-1.2-001), establishing practices for determining data origin and content lineage (MP-2.1-001), testing data flows from original sources through transformations (MP-2.1-002), and verifying that data used for retrieval-augmented generation is grounded (MS-2.5-005) ². Retrieval-augmented generation, or RAG, is the common pattern where an agent searches company content and answers from what it finds.

ISO/IEC 42001:2023, the management system standard for AI, carries a group of Annex A controls, A.7, on data for AI systems ³. They cover data acquisition, data quality requirements for accuracy, completeness, and consistency, data provenance with a documented audit trail of sources and changes, and data preparation ³. An organization seeking certification needs evidence of each.

Organizations are deploying agents ahead of definitions

IBM's 2025 survey of 1,700 chief data officers found 79% were still early in defining how to scale and govern AI agents ¹¹. Only 26% were confident they could use unstructured data, the documents and messages most agents read, to deliver business value ¹¹. IBM's 2026 study of technology executives recommended treating governance as an engineered system that defines what agents may do and keeps their decisions explainable ¹³.

A semantic layer measurably changes accuracy

The clearest public evidence comes from a 2023 benchmark by Juan Sequeda, Dean Allemang, and Bryon Jacob ⁷. They asked GPT-4 43 business questions against an insurance database built from an industry-standard data model. Querying the SQL tables directly, the model answered 16.7% correctly. When the same data was described through an ontology and knowledge graph, accuracy rose to 54.2% ⁷. On questions that required navigating a complex schema, direct SQL scored zero, while the knowledge graph scored between 35.7% and 38.5% ⁷.

A 2024 follow-up added a step that checks each generated query against the ontology's rules and repairs it ⁸. Overall accuracy reached 72%, and another 8% of responses were "I don't know," leaving an error rate of 20% ⁸. The authors worked for a company that sells data catalog and knowledge graph software, the benchmark is small, and models have improved since. The direction of the result is what matters: the same model gave far better answers when the meaning of the data was written down.

Recent Cases

Air Canada, 2024. A passenger asked the airline's website chatbot about bereavement fares. It told him he could buy a full-fare ticket and apply for the reduced rate within 90 days ⁴. The airline's own bereavement policy page, which the chatbot linked to, said the policy did not apply after travel ⁴. In Moffatt v. Air Canada, 2024 BCCRT 149, decided February 14, 2024, the British Columbia Civil Resolution Tribunal rejected the airline's argument that it was not liable for its chatbot's statements ⁴. The tribunal held the company responsible for all information on its website and said customers should not have to cross-check one part of a site against another ⁴. It ordered C$812.02 in damages, interest, and fees ⁴. The award was small. The ruling placed the error with the company even though its policy page was correct, because two company sources disagreed and nothing told the customer which one governed.

Cursor, 2025. In April 2025, users of the AI coding tool Cursor reported being logged out unexpectedly ⁵. When they emailed support, an AI agent named "Sam" replied that one device per subscription was a core security policy ⁶. No such policy existed ⁵⁶. Users announced cancellations on Reddit, and the company later apologized ⁵⁶. Public reports do not describe what sources the bot consulted. Its answer fits NIST's definition of confabulation: an invented policy, stated with confidence ².

Microsoft 365 Copilot rollouts, 2026. CoreView's 2026 survey of security leaders found roughly two-thirds of organizations had delayed or canceled Copilot deployments over concerns it could expose confidential data ¹². Among those, 73% cited the risk that AI would surface confidential internal information, and the concerns centered on SharePoint permissions and sharing links ¹². The survey's sample size was not published. The worry is that an assistant reading on a user's behalf will surface anything that user's permissions allow, including content shared too widely years ago ¹².

Why the Usual Approach Fails

The usual deployment points an agent at a document store or database, adds a retrieval index, and writes business rules into the prompt. Each part has a gap.

Retrieval ranks content by similarity to the question. It has no concept of which policy version is current, which table is the system of record, or which draft was superseded. A 2019 memo and the 2026 policy that replaced it can look equally relevant.

Database schemas hide meaning. A column named CUST_STAT_CD with values 1 through 7 means something specific to the people who built the reports. The model sees only the code. The benchmark above found direct SQL querying scored zero on complex-schema questions ⁷.

Departments define the same term differently. Finance, sales, and operations often count customers, orders, and revenue by different rules, each correct for its own purpose. An agent without a declared definition merges them.

Prompt instructions do not scale. When each agent team writes its own definitions into its own prompt, the company ends up with as many versions of "active customer" as it has agents, and none is visible to the data owners.

Access rules sit outside the agent's path. A retrieval setup that indexes content with an account able to read everything must filter results afterward, and every gap in that filter becomes a leak. The CoreView findings show executives already distrust arrangements like this ¹².

The Framework: Four Parts of a Semantic Model

A semantic model for agents has four parts. Each answers a question the agent cannot answer for itself.

flowchart LR
    A[Source systems<br/>ERP, CRM,<br/>documents] --> B[Semantic model<br/>ontology and<br/>classification]
    B --> C[Lineage and<br/>access rules<br/>checked per query]
    C --> D[Agent<br/>reasons over<br/>defined data]
    D --> E[Answer<br/>with source<br/>and lineage cited]

Three design rules make the model useful in practice.

The model is owned by the business. Data owners sign off definitions and authority flags for their domain. Engineers maintain the machinery, and the definitions belong to the people accountable for the numbers.

Access is enforced with the user's identity. The agent queries through the semantic layer on behalf of a specific person, and the layer applies that person's rights. Filtering after retrieval is too late.

Answers carry their evidence. Every response cites the source, its classification, and its refresh time. An agent that cannot find an authoritative source says so. In the 2024 benchmark, an explicit "I don't know" path converted errors into honest non-answers ⁸.

Costs, Risks, and Tradeoffs

How to Act

Questions to Ask Your Team

1. For the first agent we plan to release, which source is authoritative for each fact it will state?
2. Where do our two most-used definitions of "customer" or "revenue" disagree, and who decides?
3. If the agent gives a wrong answer next month, can we trace it to the source record and the date it was loaded?
4. Does the agent query data as the requesting user, or under an account that can read everything?
5. What happens when the agent cannot find an authoritative answer?
6. What accuracy does the agent achieve on a test set our business owners signed off?
7. Which ISO/IEC 42001 or NIST AI 600-1 data controls could we evidence today?

Closing

An agent cannot know what the company means by its own data unless the company writes it down. Air Canada's tribunal held the company responsible for what its chatbot said, and the same reasoning applies to any agent speaking for a business. Build the semantic model for each domain before an agent reads it: define the terms, mark which sources govern, record lineage, and enforce access by user. Agents built on that model give answers the company can trace and defend.