September 2026 Summaries

Shadow AI refers to AI tools, models, and agents connected to organizational data or systems without formal IT or security approval, creating risks beyond traditional shadow IT because such tools can read, alter, and trigger actions involving data and business processes. The passage argues that identity and access management systems can identify permissions but generally cannot show what an AI agent actually reads, writes, or affects downstream, making code-level data lineage and mapping necessary for effective governance. It cites September 2026 survey findings that 72% of healthcare organizations have unapproved AI tools or agents and that only 4% consider their AI governance mature, presenting healthcare as an example of a broader regulated-industry challenge. Foundational is presented as a platform that analyzes source code, applications, pipelines, integrations, and other data-touching systems to create a deterministic map of AI data access and dependencies, which it says can support compliance, audits, and trustworthy AI deployment.

FR 2052a is a Federal Reserve liquidity-monitoring report that requires Category I through III banking organizations to submit granular balance sheet, funding, and collateral information consistently across all legal entities, with filing frequency determined by institution category. The reporting process is challenging because relevant data often resides in separate core banking, treasury, and collateral systems, and manual spreadsheet-based reconciliation can create inaccuracies, weak audit trails, and difficulties explaining historical submissions to examiners. The text argues that deterministic data lineage, derived directly from application code and transformation logic, can provide a reproducible path from each reported figure to its source tables, systems, and calculations. It distinguishes this approach from manually maintained documentation, query-log inference, and conventional data catalogs, emphasizing its potential to identify changes before they affect filings, support cross-entity consistency, and reduce risks such as Matters Requiring Attention or report restatements.

DORA requires EU financial entities to maintain a continuously accurate, auditable Register of Information linking every ICT third-party provider to the critical or important functions it supports and documenting the associated data flows. With regulators increasingly comparing submitted registers against production environments after DORA took effect in January 2025, reliance on contract inventories, periodic architecture diagrams, and data catalogs can create compliance gaps because these tools often fail to capture current code changes, transformation logic, and embedded API dependencies. The text argues that deterministic, code-derived data lineage offers a more defensible approach by tracing data movement and ICT dependencies directly from application code and metadata, allowing the map to update as systems change. It presents Foundational as a platform for creating such live, audit-ready dependency maps and cites Vio’s reported reductions in potential data issues and development-cycle time as evidence of operational benefits beyond compliance.

Enterprise AI agents can produce confident but incorrect answers when they lack reliable context about the origin, freshness, transformations, dependencies, and sensitivity of the data they use. The passage distinguishes data awareness from prompt engineering and retrieval-augmented generation, arguing that retrieval can surface relevant records without confirming whether they remain authoritative or have been altered by undocumented pipelines. It defines data awareness as the ability to trace a value’s provenance through its source system, code-based transformations, timestamps, and downstream consumers, requiring a structural map of the enterprise data estate rather than documentation or warehouse metadata alone. It argues that many apparent model failures are governance failures caused by incomplete lineage information, and presents Foundational’s code-derived data graph as a solution that analyzes applications, pipelines, notebooks, legacy systems, and AI workloads to map field-level movement and use. The passage cites Ramp’s reported improvement in build success rates from 85% to 95% after adopting code-derived lineage and concludes that governed, deterministic data context is necessary for agents to act dependably.

Foundational announced at Dreamforce 2026 expanded integrations for Salesforce and Agentforce that map Salesforce objects, fields, reports, custom code, and SOQL queries into its Foundational Data Graph, linking CRM data to upstream and downstream enterprise systems. The platform analyzes source code and metadata rather than underlying customer records to trace data lineage, transformations, dependencies, ownership, usage, sensitivity, and governance policies across databases, warehouses, pipelines, BI tools, application code, and legacy systems. Through Salesforce’s Model Context Protocol support, Agentforce agents can query this connected context at runtime to verify a field’s origin, identify the impact of changes, locate metric-defining code, and assess applicable policies before responding or acting, while creating auditable records of the information used. Foundational also plans a Slackbot integration that will bring similar data lineage and governance capabilities into team conversations.