Share with your CDO
PayPal’s enterprise data governance team is making the case that shift-left data governance isn’t a best practice to aspire to, it’s a prerequisite for AI that actually works. Senior manager Brandy O’Shields argues that embedding classification, lineage, retention, and ownership requirements into system design before deployment, not after, is the only way to produce data AI agents can trust. Her framework includes hard-gate requirements in data contracts, automated metadata enforcement in CI/CD pipelines, and shared OKRs across governance, architecture, and engineering teams.
What this means for your business
Organizations that are still treating data governance as a cleanup task after systems go live are building AI on a foundation that was never engineered to support it. The gap shows up late and expensively, in model retraining cycles, compliance remediation, and AI outputs nobody can audit or explain. Where you stand on this comes down to one question: does your current development process have any hard stop that blocks a system from reaching production if its data contracts are incomplete? If the answer is no, then you’re accumulating technical debt that compounds every time a new AI workload touches that data.
O’Shields is describing something more precise than “govern early.” She’s advocating for what amounts to a data constitution embedded at the schema level, mandatory metadata attributes across six categories (business, technical, operational, provenance, classification, compliance, lifecycle, and security), with machine-enforced validation rules baked into the pipeline itself. The discipline here is not applying more governance, it’s making governance the path of least resistance for developers. Automating metadata population so engineers don’t have to think about it is the operational insight that separates this from the usual governance-as-policy-document approach that dies in committee.
The AI angle from IBM’s Kevin Fair and Salesforce Informatica’s Aashoo Saxena, both of whom have commercial incentives to frame governance as a platform problem requiring platform investment, still lands correctly: agentic AI (autonomous software that takes actions on its own, without a human approving each step) has zero tolerance for ambiguous provenance. An agent that can’t trace its data back to a trusted source will produce outputs nobody can defend to a regulator or a board. CDOs who treat governance infrastructure as a cost center to minimize are making the budget decision that will kill their AI program’s credibility long before the technology does.
Concept deep-dive: Data contracts
A data contract is a formal, enforceable agreement between the team producing a dataset and the teams consuming it, specifying what fields exist, what they mean, who owns them, and what quality rules they must meet. Think of it as a typed API contract, but for data instead of code. When violated, pipelines break loudly rather than silently passing bad data downstream. For AI specifically, contracts are the mechanism that ensures training data and inference data share the same documented lineage.
Based on reporting from PayPal exec maps a path to adopting shift-left data governance, originally published 2026-09-04 05:20:00.
