AI compliance
What to point at when an auditor asks how AI access to governed data is controlled.
Access control
Claim. An agent can access only what the operating user can access.
Evidence. The agent carries the user's identity; every enforcement layer — tenant isolation, permissions, ABAC policies, field masking — re-evaluates per request. There is no service account. Demonstrate it directly: the same question, asked by two users with different permissions, returns different answers.
Data minimisation
Claim. Agents receive no more than the user would.
Evidence. Masking is applied when the response is generated, not per endpoint, so there is no surface returning unmasked values to the AI layer. The agent receives masks and can only repeat them.
Logging
Claim. Every agent action is recorded.
Evidence. Actions land in the append-only audit log with the actor, the resource, before-and-after values, a timestamp, and a monotonic sequence. Entries cannot be modified or deleted — the database refuses it — and gaps are detectable.
This addresses record-keeping obligations for high-risk AI systems, where the requirement is that events be automatically recorded over the system's lifetime.
Human oversight
Claim. A person can understand and intervene in what the agent does.
Evidence. Mutations require an explicit preview-then-commit. Autonomy modes let an organization require individual approval for every action. Every exposed mutation is reversible. Results carry the platform's own values rather than model-generated ones, so an operator is checking data rather than prose.
Purpose limitation and consent
Claim. Consent constrains what agents can reach.
Evidence. ABAC policies can gate access on an active consent of a given type. Withdrawing consent changes what agents see, without anyone editing a permission — the same mechanism that governs every other consumer.
Special-category data
Claim. Sensitive attributes are protected by role.
Evidence. Field masking rules are configured per attribute and per role, and apply on every surface: entity reads, the 360 view, search results, match comparison screens, audit entries. Masking a value on one screen and not another is not possible, because it is not implemented per screen.
What to tell an auditor plainly
The governance property is architectural, not procedural. It does not depend on the agent behaving well, on prompt engineering, or on a policy document. The agent is not trusted not to look at restricted data — there is nothing for it to look at, because the response it received never contained it.
Next
Last verified against commit f7daa483 (2026-08-03)