Cloud governance, often neglected or treated as an afterthought, can no longer be ignored by modern enterprise operations. It is becoming a critical business issue as organisations’ growing reliance on cloud-native architectures, API-driven automation and distributed teams has increased the need for stronger framework, risk management and operational control.
While the cloud infrastructure has continued to evolve, governance has struggled to keep pace. The result is a growing gap between innovation and oversight, leaving enterprises without the policies, guardrails and controls required to keep cloud environments secure, compliant and cost-efficient.
Amidst these pressing concerns, the most overlooked areas are agent security, cross-environment policy portability, and dependency risk, where organisations may unknowingly inherit exposure through shared models, infrastructure providers, or AI supply chains.
Sharing his thoughts with iTNews Asia on how to close the gap, Charlie Dai, VP and principal analyst at Forrester, said the hardest challenge for enterprises is maintaining consistent governance across fragmented environments spanning public cloud, private cloud, SaaS, edge, and on-premises infrastructure.
Traditional IT governance frameworks were designed for stable, centralised, on-premises environments where infrastructure changed infrequently and approvals followed predictable processes. Those assumptions no longer apply.
Today’s cloud environments are advancing continuously.
Need for strong cloud governance framework
A strong cloud governance framework is not an add-on, explained Dai. It must be built into the architecture itself and modern governance requires foundational pillars.
AI agents further intensify the governance hurdles as they make decisions and take actions across multiple systems, creating new requirements for identity, authorisation, auditing, sovereignty, and compliance.
Organisation should prioritise key controls to secure their cloud architecture such as unified identity and access governance across both human and agent identities; policy-based agent governance with auditing, access controls and orchestration; and continuous observability with AI-assisted detection and remediation across cloud,SaaS, edge and on-premises environments.
-Charlie Dai, VP and principal analyst at Forrester
Emerging mitigative measures adopted by enterprises to address challenges centre on agent control planes that provide centralised registration, policy enforcement, observability, governance, and lifecycle management for agents regardless of runtime location.
Companies are also adopting workload-level sovereignty controls that focus not only on where AI runs, but also on what it does, the dependencies it relies on, and whether enterprise policies can be consistently enforced across platforms.
How to avoid AI cloud bill shock
As AI workloads drive up cloud spending, enterprises are redesigning cost-visibility frameworks to avoid AI cloud bill shock while keeping up with innovation. Without clear financial governance, Dai explained that enterprises face budget overruns and lack visibility into which teams or projects are driving costs. Cost governance must integrate tightly with real-time operational metrics.
Traditional cloud FinOps (finance and DevOps) models are insufficient because AI spending spans tokens, inference, context windows, model tiers, agent activities, licenses, and credits. Dai recommends that enterprises should evolve toward AI-aware FinOps by establishing application-level and agent-level cost attribution, linking consumption metrics directly to business outcomes, and implementing continuous governance of model selection, inference placement, and agent behaviour.
“The priority is not merely tracking spend but connecting AI investments to measurable productivity, operational efficiency, revenue impact, or customer outcomes. Organisations that build transparency across infrastructure, models, agents, and business value will be better positioned to scale innovation while avoiding uncontrolled AI cost escalation,” he said.
How enterprises can navigate cloud complexity
The industry has an opportunity to strengthen safeguards through greater collaboration on standards, governance frameworks and control mechanisms.
For organisations, Dai said the most viable pattern is a distributed hybrid architecture that combines public cloud, private cloud, and edge execution while maintaining centralised governance. Sensitive data, RAG workloads, and regulated AI services should remain close to enterprise-controlled environments, while hyperscale cloud resources can support large-scale training and elastic capacity.
“A centralised agent control plane should govern identity, policies, observability, and auditability across all deployment locations. To address sovereignty and geopolitical concerns, enterprises should adopt portable AI platforms, open-weight models where appropriate, and multi-provider architectures that reduce dependency on any single ecosystem. This allows organisations to scale agentic AI while balancing compliance, resilience, performance, and operational control,” Dai said.
Forrester’s Sharyn Leaver in her The AI Doomsday Circus blog argues that AI risk will never be zero: The way a model can hide and try to cover its tracks, and its ability to find and exploit systems that humans depend on, is real. This is why AI model testing, alignment, operational rigor, and independent oversight are essential.
True business value will come from private models and systems, especially those trained on proprietary information. A truly private model that is exposed to a narrower set of capabilities and training data will be less capable and therefore less risky than public models, but the company training the model will still need to implement safety guardrails, Leaver added in her blog.
As cloud environments become more distributed and AI-driven, governance is no longer just a compliance issue but a business strategy. Research and studies have shown that poor governance may not trigger immediate failures but over time it can drive up costs, create compliance blind spots, expand security risks and increase the likelihood of reputational damage. The impact of weak governance is often hidden until it surfaces as security breaches, compliance failures, or cost overruns.
