AI
Why Traditional Governance Fails AI
Enterprise security spent decades assuming that execution is deterministic. Identities authenticate. Systems run predefined logic. Automation does what humans told it to do. AI breaks that assumption entirely. A single prompt now makes runtime decisions and invokes actions across endpoints, cloud, and SaaS simultaneously, with no human in the loop.
“governing AI at a company like Snowflake where the AI data cloud is like laying tracks in front of a running train” — Ragini Ramalingam
AI vendors ship features weekly, sometimes multiple times a week. Traditional review cycles cannot keep pace. The execution boundary has expanded and become non-deterministic, so any governance model built for the old world is already obsolete.
Cross-Functional Steering Structure
Snowflake formed an enterprise steering committee pulling in security, IT, legal, privacy, AI/ML, data engineering, and procurement. That breadth mattered: each team could see AI adoption and usage patterns the others missed. Together they identified risks, agreed on mitigation controls (technical, process, or contractual), then escalated findings to executive leadership across engineering, product, sales, and customer experience.
“enabling or disabling AI was not a security decision. It is actually a business decision and it’s not a security trade-off. It’s a business trade-off.” — Ragini Ramalingam
Framing it that way got executive buy-in and drove the cultural change the rollout required. The committee shifted Snowflake from reactive approvals to proactive risk ownership, and that structure is what let them make decisions fast.
Visibility Pathways Into AI Adoption
“You cannot govern what you cannot see.” — Ragini Ramalingam
Snowflake used four channels to map AI adoption before writing a single policy. Procurement came first: every new AI tool went through a security review that also checked for redundant capabilities, cutting attack surface by eliminating overlapping tools. AI features added to existing products required their own security gate. Active discovery ran in parallel — Snowflake’s security lake sits on its own platform, so telemetry from endpoint, network, cloud, and SaaS environments fed queries that surfaced MCP components, models, and agents already running in the wild. The fourth channel was human: security partners embedded in each business unit fed early signals before adoption scaled.
Feature-Based Risk Assessment for GenAI Tools
GenAI vendors ship features weekly. Their enterprise control planes don’t move at the same speed. Snowflake’s response was feature-based risk assessment: enable what the existing enterprise controls can contain, gate what they can’t. The test for each feature was whether the platform gave admins the ability to manage allow/deny lists for MCP servers, tool calls, and web fetches. Features that passed went live. Features that failed became vendor requests — a direct line from security gaps to product roadmaps.
Coding Agents as an Expanded Attack Surface
Coding agents don’t just write code. They execute system calls, read and write files, call APIs, and ship with embedded browser components that bypass standard controls. One prompt can now trigger actions across the endpoint, the network, and SaaS platforms simultaneously. Snowflake’s response was a structured assessment of every execution surface — command line, desktop, browser — with feature-based risk scoring, then controls built on top of existing IT and security tooling because native enterprise control planes in most coding agents aren’t mature enough to enforce immutable configuration at the endpoint. She walked through Coding agent browser pathway containment (24:48) live. High-autonomy modes got restricted by user risk profile while the team pushed vendors for schema-based, group-level feature enablement.
Lessons Learned: What Makes Responsible AI Scale
Four things made governance work at Snowflake’s scale. Executive sponsorship drove alignment: without leadership weighing in on risk appetite, security decisions stall. Shared ownership across the steering committee scaled better than central control. Visibility came before any enforcement, because you cannot govern what you cannot see. The fourth, and most important: constrain execution authority, not adoption. Block AI entirely and users route around you.
“AI governance is not a roadblock to innovation. It really is the foundation to enable innovation securely and responsibly.” — Ragini Ramalingam
Q&A
Are you trying to prevent agents from making high-stakes autonomous decisions — like a trading agent losing half a million dollars — and if so, how? Snowflake allows only approved coding agents (assessed via their governance process), surfaces anomalies to the cross-functional team on a weekly or daily cadence, and retains executive authority to shut down a tool quickly when risk escalates. ▶ 22:58
What technical controls have you put in place to constrain execution authority? Controls depend on each agent’s own control plane: automated browser sessions are locked to internal domains, and manual browser paths are constrained via EDR to match existing enterprise-wide policy. ▶ 24:35
Notable Quotes
governing AI at a company like Snowflake where the AI data cloud is like laying tracks in front of a running train Ragini Ramalingam · ▶ 1:45
You cannot govern what you cannot see. Ragini Ramalingam · ▶ 6:53
enabling or disabling AI was not a security decision. It is actually a business decision and it’s not a security trade-off. It’s a business trade-off. Ragini Ramalingam · ▶ 6:09
AI governance is not a roadblock to innovation. It really is the foundation to enable innovation securely and responsibly. Ragini Ramalingam · ▶ 22:07
Key Takeaways
- Build a cross-functional AI steering committee with executive escalation authority before your first governance crisis.
- Gate AI features individually by available enterprise controls, not by tool — most products outpace their own control planes.
- Constrain execution authority rather than blocking adoption; shadow AI will route around any blanket prohibition.