Bigeye focuses on enforcing AI governance with Policy Engine
AI doesn't work without user confidence in the results; a new feature within Bigeye's Agent Trust Hub aims to reassure users by controlling what data agents can access.
Following its focus on data observability, Bigeye is now turning its gaze to governing AI agents.
Founded in 2019, Bigeye began as a data observability specialist with a platform aimed at enabling enterprises to trust their data. In June 2025, the vendor introduced its AI Trust Platform, marking its transition from a focus on trusting data to trusting AI. One year later, Bigeye added the Agent Trust Hub to the Agent Trust Platform to provide users with an AI observability environment that includes a registry of their agents and insight into the data that each agent accesses.
On Wednesday, Bigeye introduced Policy Engine, a feature within the Agent Trust Hub that enables users to control what data agents are allowed to access when in production.
Once agents are mapped to the data that serves them, Policy Engine performs an identity check to confirm that the agent is authorized to use the data it's accessing, checks the data itself for freshness or to see if it contains fields not approved for AI use, and weighs factors such as the identity of the agent and its requested action. Based on those considerations, the tool either allows, denies, restricts or escalates an agent's action.
In effect, the Agent Trust Hub is designed to provide users with context about their agents and the data that serves them, while Policy Engine -- now in beta preview for Agent Trust Hub users -- is designed to enforce governance based on that context.
"[Policy Engine] takes Bigeye customers from seeing what their agents do to actually controlling them," Mike Leone, an analyst at Moor Insights & Strategy, told TechTarget. "Otherwise, an agent can have every permission it needs and still pull from a table that broke this morning."
He added that while other vendors are providing AI governance capabilities that control agents at runtime, Bigeye is distinguishing itself from competitors by combining AI governance with data observability.
"Others are adding runtime controls for agents, from the AI gateways themselves to identity providers and the big data platforms," Leone said. "Bigeye stands out by also checking whether the data is in good shape before letting an agent through."
Having a governance policy is not enough
According to EY's September AI Risk and Governance Survey, 85% of the 202 senior AI executives at organizations generating at least $1 billion in annual revenue who responded to a survey reported that they have agentic AI systems operating with no human oversight. Additionally, 36% of respondents admitted to having an AI incident or failure that led to either data loss, financial damage, brand damage or operational disruptions.
Nearly all those organizations reported having formal AI governance policies. Enforcement, however, is a challenge.
[Policy Engine] takes Bigeye customers from seeing what their agents do to actually controlling them. Otherwise, an agent can have every permission it needs and still pull from a table that broke this morning.
Mike LeoneAnalyst, Moor Insights & Strategy
Just as the respondents to EY's survey reported struggling to apply AI governance to agents, some of Bigeye's customers are having trouble making sure agents understand what data they are allowed to use and for what purpose, according to Bigeye CEO Eleanor Treharne-Jones. Policy Engine was developed in response to that feedback.
"Most already have an AI governance policy, but it's written for people," she told TechTarget. "An agent never reads it, and nothing in it answers the question an agent faces hundreds of times a day: am I allowed to do this, with this data, for this purpose, right now?"
Permissions alone are not enough, Treharne-Jones continued, noting that an agent can have permission to call a tool but the data behind the tool could be stale or contain sensitive information not approved for AI use.
"Policy Engine uses the quality, classification and lineage signals Bigeye already tracks to make that call every time an agent acts," she said. "In effect, it's a guardian layer, a check on every agent action that sits outside any single agent, gateway or platform."
Policy Engine enforces governance at the AI gateway, the point at which an agent's request can be acted upon. At that point, the new tool assesses the state of the data being called upon and makes its determination.
Since Policy Engine goes beyond outlining AI governance policies to enforcing them at the point of action, Bigeye's new feature is an important addition, according to Stephen Catanzano, an analyst at Omdia, a division of Informa TechTarget.
"Policy Engine is a meaningful addition for Bigeye customers because it closes the gap between having a governance policy on paper and actually enforcing it in real time," he told TechTarget. "Policy Engine directly addresses [lack of real-time human oversight] by letting enterprises define rules once and have them applied automatically at the moment an agent tries to act."
Catanzano, like Leone, added that while other vendors, including Microsoft, Collibra and Immuta, offer runtime policy controls for agents, Bigeye is differentiating its AI governance capabilities.
"Bigeye's differentiation seems to lie less in the concept of policy enforcement itself and more in how it ties that enforcement directly to its existing data quality, lineage, and classification context … rather than acting as a standalone control layer," he said.
Beyond masking sensitive data and block agents from untrusted or unapproved datasets, Bigeye hopes to improve Policy Engine by adding capabilities that oversee approvals for high-risk actions and respond to an agent's behavior in production, according to Shane Wiggins, the vendor's vice president of AI strategy and products.
"Over time, a guardian that shows its work is what lets agents with a reliable track record earn more autonomy, within boundaries teams can still inspect," he said.
Built to enforce
With Policy Engine a new addition to Bigeye's AI Trust Platform, it remains to be seen whether it performs as intended in production to both empower agents and ensure that they access only the data they are authorized to use.
By enforcing policies through the gateways many organizations already run, Policy Engine appears appropriately constructed to carry out its intended purpose, according to Leone. However, there is room for improvement by extending the new tool's capabilities to other agents that enterprises may use, he continued.
"Ideally, Bigeye extends that enforcement to agents that don't go through one of those gateways, like the ones built into data platforms," Leone said.
In addition, Leone suggested that Bigeye could improve Policy Engine by enabling it to collect data related to blocked requests to help users determine what data issues are most critical.
"A blocked request usually means an agent couldn't finish its job, so the tables behind the most blocks are the ones worth fixing first," he said.
Catanzano noted that greater transparency into how Policy Engine goes about certain actions such as resolving conflicts and exceptions and how it handles agents operating across multiple gateways would be beneficial, he added.
"Fleshing out policy authoring tools, exception handling, and broader gateway interoperability would make the offering more complete for customers trying to govern agents comprehensively," Catanzano said.
Eric Avidon is a senior news writer for Informa TechTarget and a journalist with more than three decades of experience. He covers analytics and data management.
