An AI system is a new set of paths in and out of your information. Most of the work of protecting data around one is not novel: it is knowing which paths exist and putting a control on each. What is novel is that several of the paths do not look like data transfers to the people using them.
This page is about the technical controls. The policy side, who decides what may be used and what the retention obligations are, is covered in AI data governance and privacy, and the two are meant to be read together.
The seven paths
Enumerating them is most of the value, because a control applied to one path while another is open is a control that produces confidence rather than protection.
- Prompts. What people type or paste. The largest volume and the least visible, because pasting a contract into a chat box does not feel like sending it anywhere.
- Uploads. Whole documents attached to a conversation, including metadata, tracked changes and comments the sender did not think about.
- Retrieval. Material the system fetches on a user's behalf, which is the path that can disclose content the asker could not otherwise open.
- Integrations. Connectors to mail, storage, ticketing and line of business systems, each with its own scope and its own credentials.
- Outputs. Generated text that may contain material drawn from any of the above, sent onward to someone who was not entitled to the source.
- Logs. The record of everything above, concentrated in one place.
- Training and tuning. Where content is used to adapt a model, which is a one way transfer with properties the others do not have.
That last one deserves emphasis. NIST's Generative AI Profile describes data memorization, where information present in training data can be recovered from the resulting model, and notes it may pose exacerbated privacy risks even for data present in only a small number of training samples. A model adapted on restricted material carries that material uniformly, with no per user filter available afterward. Retrieval and fine tuning compared works through the consequence.
Classification that people can actually apply
Controls need something to act on, and elaborate schemes fail because nobody applies them. Two or three tiers with concrete examples outperform five abstract ones every time.
What matters more than the number of tiers is that the classification is attached to content in a form a system can read. A label in a document footer is a note to a human. An attribute on the file, the record or the repository is something a connector can filter on, and the difference between those two is the difference between a policy and a control.
Where classification does not exist and cannot be created quickly, repository level rules are a workable substitute: this system may be connected, that one may not. Cruder, enforceable today, and considerably better than waiting for a classification project to finish.
Minimization, which is the highest leverage control
The cheapest way to protect data in an AI system is for it not to be there. Three applications, in rough order of value.
Do not index what does not need to be findable. The default of connecting everything reachable is a decision made by omission. Material under legal hold, personnel investigations, security documentation about your own controls, and archives nobody has reviewed in years are all candidates for explicit exclusion.
Send the passage, not the file. A retrieval system that supplies the relevant extract transfers far less than one that uploads whole documents, and the extract is what the model needed.
Strip what travels invisibly. Documents carry metadata, revision history and comments. Uploading a contract can transmit an earlier negotiating position nobody intended to send.
Redaction, and its honest limits
Automated detection of names, account numbers, national identifiers and payment details before content leaves the boundary is genuinely useful and genuinely partial.
Pattern matching finds structured identifiers reliably. It is much weaker on the sensitivity that lives in context: a sentence naming no one that is identifying to anyone who knows the situation, a project codename, a combination of ordinary facts that is unique to one person. Redaction should be treated as a reduction in exposure, not as a permission to send restricted material through a general path.
It also breaks things. Over-aggressive redaction removes the context the model needed and produces answers that are wrong in ways nobody can trace, because the input the model saw is not the input the user thinks it saw.
Egress, and the model provider question
Where content leaves your environment, the control is contractual and it is worth reading rather than summarizing. What is retained, for how long, who can access it, whether it is used to improve the provider's models, and where processing occurs. Consumer and enterprise tiers of one product routinely differ on all five.
Technically, the controls are the ordinary ones: restrict which endpoints the environment may reach outward, keep credentials in a secrets manager rather than in configuration, and monitor the egress path as you would any other. NIST's SP 800-53 catalog covers this ground for systems of any sensitivity; nothing about AI requires a separate framework for it.
Output filtering, which is where disclosure actually happens
Every control above concerns what goes in. Disclosure happens on the way out, and it happens because the system assembled an answer from material the recipient was not entitled to.
The structural answer is that retrieval is filtered by the asker's permissions before generation, which is the argument in secure RAG architecture. Filtering the output afterward is a weaker position, because by then the content has been paraphrased into a form that pattern matching does not recognize.
Two secondary controls are worth having anyway. Constrain answers to the retrieved material, so the model cannot supply from elsewhere. And attribute answers, so a recipient can see that something came from a document they should not have been shown, which is frequently how a filtering fault is first reported.
The log is a data protection problem too
Prompts and responses collected in one place are a concentrated store of exactly the material people asked about, which is often more sensitive than any single source. It needs its own retention period, its own access control and its own entry in the classification.
Retaining everything indefinitely is not the cautious option. It is a second exposure created in the name of the first, and it is covered in AI logging, monitoring and auditing.
Where protection and usefulness genuinely conflict
It is worth being honest that some of these controls cost capability, because a page that pretends otherwise produces controls that get switched off.
Minimization reduces what the model can draw on, and a system restricted to a narrow set of sources will sometimes fail to answer a question whose answer exists elsewhere in the organization. Redaction removes context and can produce confidently wrong answers built on incomplete input. Permission filtered retrieval means two people asking the same question receive different answers, which is correct and confusing, and needs explaining rather than hiding.
The resolution is not to weaken the controls but to place the cost where it is acceptable. Broad access on non sensitive material, narrow access where the material is restricted, and a clear statement to users about which they are working in. A single environment tuned to a compromise between the two serves neither well.
What to test
- Paste a document from a restricted category into the approved tool and see whether anything stops it.
- Ask the assistant a question whose best answer is in material the asker may not read.
- Upload a document with tracked changes and check what actually left.
- Ask what happens to a conversation after ninety days, and get an answer that cites the agreement rather than an assumption.
- Remove a user's access to a source system and confirm the assistant stops returning its content.
Each is a test that can fail, and the ones that fail are the roadmap.
Where to go next
The policy and accountability side is AI data governance and privacy, and the controls that govern generative AI use across an organization are in secure generative AI for business. The access model is AI identity and access management, and the wider environment is how to build a private AI environment.
LABUSA works through these paths as part of securing an enterprise AI environment, usually starting from the inventory rather than the architecture. Get in touch to discuss yours.
Sources and further reading
- National Institute of Standards and Technology, AI Risk Management Framework: Generative Artificial Intelligence Profile, NIST AI 600-1, July 2024. The source for data memorization and for the Data Privacy risk category.
- National Institute of Standards and Technology, Security and Privacy Controls for Information Systems and Organizations, SP 800-53 Revision 5.
- OWASP GenAI Security Project, OWASP Top 10 for LLM Applications, 2025, including LLM02 Sensitive Information Disclosure.
Every source above was opened and read on 20 August 2026.