Governing an AWS estate buys you five things in 2026, and AWS documents all five itself. Four sit on its data governance hub and describe work a person does: curate at scale, discover in context, share securely, reduce regulatory risk. The fifth is runtime context, and the AWS Glue Data Catalog, Lake Formation, AWS Context and Atlan’s context layer each carry part of it. AWS Prescriptive Guidance calls mature governance the foundation that lets agents operate autonomously.
This page answers the benefits question and stops there: what AWS itself names, which AWS services deliver each one, what shipped in June 2026, and what AWS’s own agent guidance adds. It does not pick a product. Three neighboring questions have answers of their own. Which AWS-native layer to stand up first, Amazon DataZone or the Glue Data Catalog, is settled in AWS DataZone vs Glue Data Catalog. Whether the AWS-native stack is enough for an estate that already runs past AWS is a stack-versus-category question. Amazon DataZone against Atlan specifically is a product decision, carrying pricing and lineage detail this page leaves alone.
What follows:
- What AWS itself names as the benefits, in AWS’s own words
- Which AWS services deliver each one, what shipped in June 2026, and what status it carries
- The benefit AWS’s own agent guidance describes, and where AWS documents it
- Where that benefit stops, and who answers the comparison questions
| Field | Answer |
|---|---|
| What data governance on AWS is | The processes, policies, roles, metrics and standards managing AWS data assets, enforced through AWS account, permission and catalog services. |
| Benefits AWS names | Curate at scale to limit data sprawl; discover and understand data in context; protect and securely share it; reduce business risk and regulatory exposure. |
| The 2026 addition | Runtime context for AI agents: the definitions, ownership and access rules an agent reads before it acts. |
| Services involved | AWS Organizations, AWS Config, IAM, AWS Data Exchange, AWS Clean Rooms, AWS Lake Formation, AWS Glue Data Catalog, Amazon DataZone, AWS Context. |
| Where it stops | At the platform boundary. Automated lineage capture in SageMaker Unified Studio supports two connection types, AWS Glue and Amazon Redshift. |
| Who this is for | Data and platform teams on AWS being asked what governance buys them now that agents query the estate. |
What are the four benefits of data governance on AWS?
Permalink to “What are the four benefits of data governance on AWS?”AWS publishes four benefits of data governance on its own hub page, and each maps to specific AWS services that deliver it. According to AWS’s data governance hub (verified 2026), governing an AWS estate lets a team “curate data at scale to limit data sprawl,” “discover and understand your data in context to accelerate data-driven decisions,” “protect and securely share your data with control and confidence,” and “reduce business risk and improve regulatory compliance”.
Those four are accurate and they stay accurate. Curating at scale is a definitional job before it is a storage job: one agreed meaning per table, per metric, per owner, the same discipline teams formalize in data contracts for AI. Discovery in context depends on which types of metadata for AI agents are populated, because a search box over undescribed tables returns names, not meaning.
Protecting and sharing is the permission layer. AWS Lake Formation centralizes fine-grained grants over data lake assets, IAM carries identity, and AWS Clean Rooms lets partners collaborate without exchanging raw data, which together describe the access posture usually called zero-trust data governance. Reducing business risk is monitoring, auditing and evidence through AWS Organizations and AWS Config, and it is where the boundary between data governance and AI governance starts to matter, because the audit question becomes what a model was allowed to see. Provenance sits underneath all four, which is why data lineage for AI is the artifact teams reach for first when an answer looks wrong.
Practitioners state the same list less tidily. A long-running r/aws thread on data governance best practices puts it as “how to ensure security of the data, access controls, quality of the data, lineage, maintaining meta store, good documentation for the datasets”.
| Benefit (AWS’s words) | What it covers | AWS services involved |
|---|---|---|
| “Curate data at scale to limit data sprawl” | One definition per asset, not duplicates across accounts | AWS Glue Data Catalog, Amazon DataZone, AWS Config |
| “Discover and understand your data in context to accelerate data-driven decisions” | Search, business descriptions, ownership, the meaning behind a column | AWS Glue Data Catalog, Amazon DataZone |
| “Protect and securely share your data with control and confidence” | Fine-grained permissions, sharing without copying, third-party exchange | AWS Lake Formation, IAM, AWS Clean Rooms, AWS Data Exchange |
| “Reduce business risk and improve regulatory compliance” | Monitoring, auditing, retention, evidence a regulator will accept | AWS Organizations, AWS Config, IAM |
Read together, the four describe a governed estate a person can trust. Since AWS wrote them, that estate has acquired a second kind of reader.
Which AWS services deliver each governance benefit?
Permalink to “Which AWS services deliver each governance benefit?”AWS spreads data governance across four layers: account-level controls from AWS Organizations, AWS Config and IAM; permissions in AWS Lake Formation; a catalog holding the technical metadata AWS query engines read, which Athena, Redshift Spectrum and EMR hit directly; and, since June 2026, two agent-facing context capabilities. AWS Data Exchange and AWS Clean Rooms cover data that arrives from or goes to somebody else.
Amazon DataZone sits above the permission and catalog layers as AWS’s business-facing service for cataloging, discovering, sharing and governing data across accounts and domains; it remains generally available and standalone, and SageMaker Catalog is built on it. AWS documents its own limits, including the AWS Glue Data Catalog limitations on data lake frameworks, and packages the catalog with analytics services in the Amazon Q, QuickSight and Glue bundle.
Two announcements on June 17, 2026 changed what this inventory is for. AWS Context maps relationships across existing data into a knowledge graph and provides agentic search “so AI agents in the organization can access governed data relationships, business rules, and domain knowledge at runtime.” It integrates the Glue Data Catalog, SageMaker Unified Studio and Lake Formation, publishes to Amazon S3 in Apache Iceberg format, and is coming soon rather than generally available. The same day, AWS put business context and semantic search into the Glue Data Catalog in preview across four regions, adding glossary terms, custom metadata fields, and skills that direct agents to additional data context. That turns the catalog into an MCP-connected data catalog agents retrieve from, and the surface an AWS Bedrock enterprise agent reads to learn what a column means.
AWS’s own January 2026 implementation guidance frames the same job operationally, as monitoring, preventive controls and automated remediation.
| Service | Governance job | Status and date |
|---|---|---|
| AWS Organizations | Manage every AWS account and apply policy centrally | GA |
| AWS Config | Record resource configuration for audit evidence | GA |
| AWS IAM | Identity, roles and policy documents across AWS | GA |
| AWS Data Exchange | Find, subscribe to and use third-party data | GA |
| AWS Clean Rooms | Collaborate with partners without sharing raw data | GA |
| AWS Lake Formation | Centralized fine-grained permissions over data lake assets | GA |
| AWS Glue Data Catalog | Technical metadata for AWS query engines | GA; business context and semantic search in Preview, four regions, June 17, 2026 |
| Amazon DataZone | Catalog, share and govern data across accounts and domains | GA and standalone; SageMaker Catalog built on it, domain upgrade path since June 2, 2025 |
| AWS Context | Knowledge graph plus agentic search over governed relationships | Announced June 17, 2026; coming soon, not GA |
That inventory covers what AWS ships and what it has announced. What an agent needs from it gets answered in a different set of AWS documents.
WTF is the context layer?
Everyone is using the term and almost nobody agrees on what it means. The ebook works through what a context layer is, what it is made of, and how to tell a real one from a rebrand.
Get the Context Layer EbookWhat changed in 2026: AWS’s own documents describe two different jobs
Permalink to “What changed in 2026: AWS’s own documents describe two different jobs”Two AWS documents describe the purpose of governance differently, and both are current: the data governance hub, and the guidance on securing agentic AI systems. The hub page’s four benefits are written for a person: someone who curates, discovers, shares and reports, and whose only AI-adjacent concern in that document is auditing how models access data.
AWS Prescriptive Guidance, writing about securing agentic AI systems, states the job differently: “Mature data governance provides the foundation that enables agents to operate autonomously while respecting organizational data protection policies.” That is a claim about precondition, not about reporting.
The product announcements say the same thing in a product voice. According to Mai-Lan Tomsen Bukovec, Technology Vice President at Amazon Web Services, who wrote the post announcing AWS Context on June 17, 2026, “Agents are only as intelligent as the context they can reason over.” A knowledge graph over governed relationships is the shape that answer takes, which is why what a context graph is has become an AWS question and not only a vendor one.
AWS framed a version of this before agents arrived. According to Tom Godden, Executive in Residence at AWS, writing in November 2024, 39% of respondents cite data challenges such as cleaning, integration and storage as barriers to using generative AI. In 2024 the framing was data quality. By mid-2026 it is context read at runtime, a different requirement with different core components of a context layer behind it.
| AWS’s data-governance hub says | AWS’s agentic-AI guidance says |
|---|---|
| Analysts, data scientists and ML teams consume the metadata | Agents consume it, retrieve, and then act |
| Context is a business description that helps a person understand a dataset | Context is governed data relationships, business rules and domain knowledge, read at runtime |
| Failure is data sprawl, slow discovery and compliance exposure | Failure is an agent acting on a definition nobody checked |
| The control is permissions, cataloging, monitoring and audit | The control is mature governance as the precondition for autonomy |
| The document helps you choose and run AWS governance services | The document helps you secure agentic systems built on AWS |
AWS is moving quickly here, so the durable point is structural: a context surface belongs to the platform that owns the identity and policy model, which is why the difference between a data catalog and a context layer is a question about consumers before it is a question about features.
Both AWS documents are right about their own reader. The benefits page is right about the analyst; the agent guidance is right about what happens when nobody is reading, which is the state metadata management for AI now has to plan for.
What do AI agents need from a governed AWS estate that analysts did not?
Permalink to “What do AI agents need from a governed AWS estate that analysts did not?”An agent reading a governed AWS estate needs what the catalog and permission layers already hold: definitions, ownership and access rules, delivered at query time and in a form it can act on. That is the fifth benefit: governing an AWS estate now supplies runtime context, read before a system acts rather than after somebody questions the number. An analyst who gets a strange result pauses. Software that gets a strange result usually proceeds.
This is not an assertion about AWS. It is three AWS artifacts stacked: Prescriptive Guidance on autonomy, an AWS Technology VP on context, and two shipped agent-facing capabilities. Preparing for that consumer is a different exercise from preparing a dashboard, which is why how to prepare enterprise data for AI agents and how to give AI agents access to enterprise data are separate disciplines from analytics enablement.
AWS’s documents establish the requirement; independent benchmarks show why it bites. According to Lei et al. (2024/2025), the Spider 2.0 benchmark put 632 real enterprise text-to-SQL problems on databases with over 1,000 columns, and the strongest model tested, o1-preview, solved 21.3% of them, against 91.2% on Spider 1.0 and 73.0% on BIRD. The difficulty is not the SQL. It is knowing which of a thousand columns means what, which is the whole problem text-to-SQL for enterprise runs into on a real warehouse.
The corollary is measurable in the other direction. In the Atlan AI Labs enhanced-metadata benchmark, the model was held constant and only the context supplied to it changed: query win rate moved from 16.1% to 22.2% across 174 unique queries and 522 evaluations on a 13-table, 94-column dataset, a 38% relative improvement at p < 0.0001. That is also the practical argument for a semantic layer for AI agents and the retrieval plumbing underneath it, which is where MCP matters for AI agents and where context engineering stopped being a research term and became a delivery practice.
The governance work an analyst needed and the context an agent needs are the same artifacts: definitions, ownership, lineage, policy. The difference is that a wrong definition now leaves the building as an action.
Is your AWS estate ready for agents to read it?
A checklist covering definitions, ownership, lineage and access, and which parts of your context an agent could act on today.
Run the Readiness ChecklistDoes AWS-native governance reach an estate that runs past AWS?
Permalink to “Does AWS-native governance reach an estate that runs past AWS?”The fifth benefit, runtime context for AI agents, holds as far as the context surface that carries it reaches. Both agent-facing context capabilities AWS announced in June 2026, AWS Context and the Glue Data Catalog preview, are scoped to AWS. That is a scope statement rather than a criticism: a context surface inherits the identity and policy model of the platform it belongs to.
The estate is often mixed whether or not anyone planned it that way. According to Flexera’s 2026 State of the Cloud report, based on 753 technical professionals and executive leaders surveyed in winter 2025, hybrid cloud leads at 73% of organizations, up three percentage points year over year, a pattern Flexera describes as “potentially driven by mergers or siloed applications rather than deliberate strategy.” The seam usually arrives through an acquisition or an inherited system, not through a strategy document, which is how multi-cloud data governance becomes somebody’s problem on a Tuesday.
Two facts bound the scope. Automated lineage capture in SageMaker Unified Studio supports two connection types, AWS Glue and Amazon Redshift, so lineage past those is a separate exercise. And AWS does reach beyond itself in places, through Glue catalog federation, a DataZone Snowflake source, and documentation naming third-party catalogs; the stack-versus-category question those exits raise is answered on its own page.
The AWS-native path is the bundle option, and build vs buy vs bundle carries real trade-offs. What a mixed estate adds to that calculation is portability: whether definitions survive the crossing, the subject of context portability; whether the layer holds across clouds, which is what a multi-cloud context layer is for; and whether it stays model-agnostic as the model roster changes. A data lakehouse for AI is usually where that mixed estate physically lands.
Platform-bounded governance still works on the platform. The consumer that queries across the seam is the one it cannot reach.
How Atlan approaches context on an AWS estate
Permalink to “How Atlan approaches context on an AWS estate”Atlan sits above the AWS-native catalog and permission layers rather than replacing them. The same definitions travel to agents querying outside AWS. A governed AWS estate answers whether people can find and trust this data. The context layer answers the next question: whether an agent reasoning over that data inherits the same rules, definitions and ownership, including where the estate reaches past AWS.
On the AWS side that means reading from S3, AWS Glue, Athena, Redshift, EMR, MSK and Kafka, QuickSight and SageMaker Unified Studio, with Lake Formation contributing its permission model rather than being replaced. Atlan is available through AWS Marketplace. The AWS-documented limitations for data lake frameworks in Glue, covering Delta Lake, Apache Iceberg and Hudi, show where an added layer earns its keep: holding one definition across the systems on either side of a documented constraint is not a job for any single engine.
What gets built is an Enterprise Data Graph: schema, lineage, glossary definitions, ownership and policy in one queryable structure, which is what the enterprise context layer means in practice and what an agent context layer reads at runtime. For the people who own the definitions, that daily work is context layer for data governance teams, and the sequencing question, which surface to stand up first, is worked through in how to implement an enterprise context layer for AI.
The AWS-native layers stay where they are. What gets added is one place where a definition is true for every agent that asks, whichever side of the boundary it is standing on.
See a context layer running against a real estate
Live sessions walking through lineage, glossary definitions and agent retrieval on a working environment.
Watch a Live DemoThe governance work did not change. The reader did.
Permalink to “The governance work did not change. The reader did.”AWS’s four benefits are still the right answer for the person who can notice when a number looks wrong. Curation, discovery, controlled sharing and reduced risk describe an estate a team can work in, and what AWS shipped in 2026 sits on top of that.
The fifth benefit exists because the thing reading the output increasingly cannot notice. It reads the definition, takes it as given, and acts. That is why AWS’s own agentic-AI guidance treats mature governance as a precondition rather than a reporting function, and why the glossary entry that used to save an analyst ten minutes now decides whether a workflow is correct. Teams building that runtime layer deliberately tend to work through how to build an AI agent harness at about the moment they finish the catalog.
The governance work is the same work it always was. What changed is who is reading the output, and how much of it they need before they act.
FAQs about data governance on AWS
Permalink to “FAQs about data governance on AWS”1. How does AWS support data governance?
Permalink to “1. How does AWS support data governance?”AWS supports data governance through four layers of service. Account and policy controls come from AWS Organizations, AWS Config and IAM; permissions come from AWS Lake Formation; cataloging spans the AWS Glue Data Catalog for technical metadata and Amazon DataZone for business-facing cataloging and access workflows; and since June 2026 two agent-facing context capabilities extend the same definitions to AI agents.
2. What are the benefits of data governance on AWS?
Permalink to “2. What are the benefits of data governance on AWS?”AWS names four on its data governance hub: curating data at scale to limit data sprawl, discovering and understanding data in context, protecting and securely sharing it, and reducing business risk and improving regulatory compliance. AWS’s own agentic-AI guidance describes a fifth, calling mature data governance the foundation that lets agents operate autonomously, which makes runtime context for agents the fifth benefit, named in AWS’s agent guidance rather than on the hub page.
3. Does AWS have a data governance tool?
Permalink to “3. Does AWS have a data governance tool?”AWS has several, and they do different jobs. AWS Lake Formation manages fine-grained permissions, the AWS Glue Data Catalog holds technical metadata for AWS query engines, Amazon DataZone catalogs and governs data across accounts and domains, and AWS Organizations, AWS Config and IAM carry account-level policy, configuration recording and identity.
4. Will AI replace data governance?
Permalink to “4. Will AI replace data governance?”No. AWS Prescriptive Guidance describes mature data governance as the foundation that enables agents to operate autonomously while respecting organizational data protection policies, which makes governance a precondition for agentic AI rather than a casualty of it. What changes is the consumer: definitions, ownership and access rules now get read by software that acts on them.
5. What are the four pillars of data governance?
Permalink to “5. What are the four pillars of data governance?”The AWS Cloud Adoption Framework organizes data governance into roles, standards, policies and quality metrics. Roles cover data owners, stewards and custodians; standards cover data dictionaries, taxonomies and business glossaries; policies cover classification, retention, encryption and purging; and quality metrics measure whether the data meets the standard.
6. Is Amazon DataZone still available, or has it been replaced by SageMaker Catalog?
Permalink to “6. Is Amazon DataZone still available, or has it been replaced by SageMaker Catalog?”Amazon DataZone is still generally available and still standalone, and SageMaker Catalog is built on it. AWS shipped a domain-upgrade path on June 2, 2025 that moves a DataZone domain into SageMaker Unified Studio, and both portals remain accessible after the upgrade.
Sources
Permalink to “Sources”- Data governance with AWS, AWS
- Data security and governance for agentic AI systems, AWS Prescriptive Guidance
- Context intelligence for your data and AI agents at scale, AWS Machine Learning Blog (2026)
- AWS Glue Data Catalog business context and semantic search (Preview), AWS What’s New (2026)
- Implementing data governance on AWS, Part 1, AWS Security Blog (2026)
- Implementing data governance on AWS, Part 2, AWS Security Blog (2026)
- Data governance, AWS Cloud Adoption Framework
- What is data governance?, AWS
- What is AWS Lake Formation?, AWS Documentation
- AWS Glue Data Catalog and crawlers, AWS Documentation
- Data lake framework limitations in AWS Glue, AWS Documentation
- What is Amazon DataZone?, AWS Documentation
- Amazon DataZone domain upgrade to SageMaker Unified Studio, AWS What’s New (2025)
- Data governance in the age of generative AI, AWS Enterprise Strategy Blog (2024)
- 2026 State of the Cloud Report, Flexera
- Spider 2.0: enterprise text-to-SQL evaluation, arXiv 2411.07763
- How enhanced metadata improves query accuracy, Atlan AI Labs
- Data governance best practices on AWS, r/aws
