AI-ready is the fifth ring, not the first

This month, a data governance leader we spoke with summed it up in one line: everyone is working backwards, chasing exciting AI capabilities without building the foundation. The agent pilot gets a budget. The question of which system holds the real customer list doesn't.

John Wernfeldt's framework shows the whole picture as six rings, one inside the other. Data foundation sits at the centre, followed by data management, decision authority, trusted analytics and AI ready, with the operating model wrapped around all of them. His caption makes the useful point: you don't have to do everything, "just well enough to proceed to the next ring."

TL;DR: Preparing data for AI agents works from the inside out. First know what data you have, then manage it, then decide who owns definitions and access, then make the numbers traceable, and only after that let AI read it. A small company can't staff six rings of governance, and it doesn't need to. A data layer between your business tools and your AI tools covers most of the inner rings by default, which leaves people free for the parts only people can do.

The six rings, cut down to what a 30-person company needs, built from the inside out. Ring structure after John Wernfeldt's "Data governance, the whole picture".

Why do AI projects start at the wrong ring?

Because the outer rings are where the demos are. Connecting an AI tool to a business app takes minutes. Everything further in stays invisible until an answer comes back wrong: whether the data is current, whether "customer" means one thing, who is allowed to see salaries.

The pattern shows up in surveys too. A March 2026 survey of more than 550 SMB leaders by ECI found that data readiness was one of the top barriers to AI adoption. The AI-ready ring, with its retrieval scope and agent audit trails, assumes the four rings inside it already exist.

Ring 1, data foundation: know what you have

At enterprise scale this means an inventory of source systems, master data and a system of record for each entity. At 30 people it means listing the tools where business data lives and getting a current copy of each into one place.

Synquil does this with read-only connections, about 10 minutes per source, and scheduled syncs. Your tools stay the system of record, and Synquil keeps a synced copy for AI to read. Good enough to move on: every tool that holds business data is connected and up to date.

Ring 2, data management: one shape, with access built in

The enterprise list here includes quality rules, a metadata catalogue, a lineage map, access controls and a retention schedule. The small-company version is shorter: a consistent structure, a known meaning for each field, and access decided per person.

Synquil drafts one connected schema across your sources, with consistent names and types and duplicates removed. Each table records which source it came from, columns carry descriptions so the AI knows what a field means, and schema changes in a source are detected and flagged. On the Team plan, access can be granted down to individual columns. Good enough: every table has a known source and a known meaning.

Ring 3, decision authority: someone approves, someone decides

Enterprises keep definition registers, decision rights, change approval and decision logs. At your size, it means one person approves what the AI can read and decides who sees what.

In Synquil, nothing goes live until an admin reviews and applies the drafted schema. New tables stay invisible until someone grants them. Access is default deny: you grant a whole source, specific tables or specific columns, and everything else stays out. Good enough: no data reaches anyone's AI without a decision.

Ring 4, trusted analytics: every figure traceable

This is the ring of certified metrics and one number per KPI. In practice, that comes down to two tests: the same question gets the same answer, and you can show where the answer came from.

Synquil turns each question into one validated, read-only SQL statement against your own rows, and every AI tool reads the same layer. It also measures joins between sources. A match rate is the share of rows in one table that find a partner in another table on a given join. Joins with a weak match rate are kept out of answers. The audit log stores the SQL behind every answer, so any figure can be traced in minutes. Reconciling two systems against each other, such as billing against accounting, isn't built yet.

Ring 5, AI ready: scope what each AI can see

Here the enterprise list gets long: training data approval, bias checks, consent flags, evaluation sets, drift monitoring, output guardrails, model cards. A company that uses Claude and ChatGPT, rather than training its own models, should start with three items: retrieval scope (what the AI can read), PII boundaries (which columns never reach it) and agent audit trails (what it asked).

All three are part of Synquil. Each person's AI receives only the slice of data they've been granted, and anything else is invisible to it, not just refused. Salary or personal columns can be left out of everyone's slice. Every query is logged, including blocked attempts, and the log exports to CSV. Agent-governance tools govern what agents do. Synquil governs what they see. Bias checks, evaluations and output guardrails belong to whoever builds the model or reviews what the agent does with its answers.

Ring 6, the operating model is people, and should stay that way

Accountability charts, decision cadence, data owners, steward hours: no software buys you these. At 30 people, this ring is one named owner (often the ops lead), a monthly 30-minute review of the audit log, and a decision on access whenever someone joins or leaves.

Synquil makes this ring smaller but doesn't remove it. Offboarding is a single request. The Questions tab groups the questions that came back empty by what was missing, so the owner knows what to connect next, and it is recorded without any link to who asked. The owner still has to make the decisions.

Where to start

If one person uses AI on one spreadsheet, you're still at the centre ring, and that's fine. Governance starts to matter the day a second person's AI can read company data.

The rings are drawn from the inside out for a reason. AI-ready isn't a ring you can start on. It's what you get once the rings inside it hold. Do each one well enough, then move outward. AI needs context. Businesses need control.

See how Synquil builds the inner rings, step by step, at synquil.com/technical.