The Reality Check • 9 Min read
Certify the path, not the estate: How to rebuild your data foundation to be ready for the age of AI
AI agents can act, but can you hold them accountable? Why agent identity, auditability and scoped access are the missing layer for trusted enterprise AI.
Overview
A few years ago, our data team was where many data teams still are: scaling fast without the structure to support it, and nowhere near ready for AI.
We had thousands of users, hundreds of databases, dozens of source systems and no shared standards. Sales, finance and HR each had a revenue number. Each was calculated differently; each was defensible; and none of them matched.
We sell a data platform. We weren't practicing what we sold.
What we built to fix it is an internal certified data layer we call Snow Certified. The more useful lesson isn't the system itself. It's the order of operations, a principle I've come to describe as “certify the path, not the estate.” But before we could build anything, we had to identify the problems clearly.
Four gaps that blocked AI
Inconsistent metrics: The same question returned different answers depending on who asked. Everyone was right by their own logic.
Unverifiable numbers: Analysts couldn't confirm whether a number was fresh or accurate without reading the source query themselves. That doesn't scale.
Blunt access controls: Sensitive data was either open too broadly or locked down completely, with nothing in between.
- Bespoke AI engineering: With no shared semantic layer (the translation between raw tables and the language of the business), every new AI use case meant rebuilding business context from scratch.
None of these is an AI problem on its own. Together, they made AI impossible to trust. An agent asked about revenue has to give the one correct answer, every time. You can’t be almost right about Q1 revenue.
Start with the answer, not the source
The most important decision we made wasn’t particularly intuitive. Most data programs start at the source systems and work their way up, cleaning as they go. We started at the top, with the definitions people actually consume, before writing any transformation logic.
If an organization can't agree on what "revenue" means where people read it, it will never agree on it upstream. So we defined those business terms first, in a semantic layer, and treated that layer as a contract. Everything beneath it had to serve it. From there, we worked backward, tracing the outputs people needed and certifying only that path, rather than trying to clean the entire estate.
That choice does carry a tradeoff. Certifying the path leaves parts of the data estate untouched, and some teams wait longer for their corner of it. But a narrow foundation that’s right beats a broad one that’s almost right. Completeness can follow, but trust can't be retrofitted.
The result is a single set of certified definitions that every surface reads from, whether that's an AI agent, a dashboard, an internal app or an analyst's ad hoc query.
Access follows the same logic. Permissions in the certified layer mirror the systems of record. A seller who owns five accounts in the CRM sees those accounts, and a manager sees their own team and everyone who reports into it. The layer now spans about 900 models across 27 business domains, including finance, sales, HR and product. We built it in eight months.
Using AI to build the foundation AI depends on
Being customer zero means we use our own products before customers do. That included using AI to build the foundation AI depends on. It's the part of this work I'm proudest of the team for.
Our analytics engineering team adopted an AI coding agent, Snowflake CoCo, early, and treated it as an engineering partner rather than autocomplete. It works from our codebase and our standards, and it runs a full loop: plan, implement, test and verify. The team captured its patterns, governance templates and testing rules as a shared library of more than 60 reusable skills, so every engineer starts from the same standard.
We also put an autonomous agent into production to maintain those pipelines. When something breaks, it traces the root cause, proposes a fix and opens the change under its own agent identity, without human intervention.
Five principles for leaders building a modern data foundation
For leaders on this path, or deciding whether to start, here's what we learned:
Define the answer first:. Agree on business definitions where people consume them, and let that agreement force alignment upstream. It's harder than starting with the sources, and it's worth it.
Certify the path, not the estate:. Trace the outputs that matter and certify those. Scope is a strategy, not a compromise.
Make everything earn its place:. Review, document and optimize everything that enters the certified layer. Cleanup that gets deferred rarely happens.
Enforce standards in the system, not in a policy document:. Naming, testing and access rules belong in the system itself, so the right thing is the easy thing. Governance that depends on good intentions doesn't hold.
Treat data as a product:. That means a roadmap. Ownership. A data council. Standards that are maintained, not just published.
Why the data foundation is your AI strategy
The strongest returns on AI aren't coming from bigger models. They're coming from organizations that did the unglamorous work of getting their foundation right first.
Agents that work are built on data that is trusted, governed and consistent in meaning. Every shortcut in the foundation becomes a tax, paid with interest at exactly the moment an organization is trying to move fast.
We didn't build this because it was easy. We built it because we couldn't credibly ask other enterprises to become AI -ready if we weren't ourselves.
The organizations that lead the next phase of AI won't be the ones that clean everything first, and they won't be the ones that skip the foundation to move faster. They'll be the ones that decide what has to be true, then build only what it takes to make it true.
