Platform
Put policy between AI and enterprise data
Every data request an AI system makes passes through identity, accountability, policy and risk before anything is returned. The sink is the control point.
Approved sinks
- warehouse.eu
- warehouse.in
2 destinations, for 9 sources across 3 residencies. The shortness of this list is the control.
Where the control belongs
The sink is the control point, not the prompt.
Almost every attempt to control what AI sees operates on the prompt — redaction, classifiers, instructions not to reveal things. That is the wrong end of the pipe, because a filter has to anticipate every phrasing and a destination list does not.
Ask what could go wrong with a data-hungry agent and the answer is usually "it might reveal something". So the instinct is to inspect what comes back. But the question a control can actually answer is narrower and much more useful: where is this allowed to end up?
There are 2 approved destinations in this estate. Everything else is refused at the action rather than flagged afterwards — and a refusal happens before the read, so there is no retrieved copy to worry about.
- It is a finite list
- Two approved warehouses. A prompt filter has to anticipate infinite phrasings; a sink rule enumerates destinations, and the enumeration fits on one line.
- It is evaluated before the read
- The decision happens when the request is made, not when the response is inspected. Nothing is redacted after the fact because nothing was retrieved.
- Somebody already owns it
- The team that owns the warehouse owns the sink list. That is a real owner with a real reason to keep it current, unlike a regex nobody has read since it was written.
- It fails loudly
- An unapproved destination is refused and recorded. A prompt filter that misses something fails silently, which is the worst property a data control can have.
The policy that does it
Two clauses, and the second one is the whole idea.
Owned by Security, because Security carries the consequence of an export. It names the destinations, refuses the classified columns, and freezes the agent on a violation rather than logging it.
pii.export_block
Security wrote this · 2 Aug 2026Personal data leaves only through an approved sink. Everything else is stopped at the action, not flagged after it.
# the sink is the control point, not the prompt
bound export.dataset {
sink in ["warehouse.in","warehouse.eu"]
columns !~ classified("pii.direct")
unless approved_by("Security") && ttl <= 24h
on_violate deny + freeze(agent)
}Scope: export.dataset · read.contract
Change history
- v11In forcetightened after a review2 Aug 2026
- v10scope widened to a second system11 May 2026
- v1first published by Security24 Mar 2026
Read the sink clause first.
sink in [...] is the line that does the work. It is an allow-list of two warehouses — not a deny-list of things to watch out for, which is the distinction between a control that holds and one that is eventually outrun.
The column clause is the backstop: even into an approved warehouse, directly identifying fields do not travel. And on_violate freezes the agent, because an attempt to move personal data somewhere unapproved is not a retry-and-hope situation.
Every source, and where it may go
Classification says what it is. The sink list says where it may end up.
Read the fourth column rather than the second. Two rows may be written nowhere at all — a contract can be reasoned about without a copy of it leaving, and that is the strictest and most common correct setting for documents.
Data source register
9 sources · 2 approved sinks · 14 read grants| Source | Classification | Residency | Approved sinks | Governed by | Readers |
|---|---|---|---|---|---|
| PostgresOrder historydatabase | pii.indirect | ap-south-1 | warehouse.in | pii.export_block | 3 |
| Zoho BooksGeneral ledgerapplication | financial | ap-south-1 | warehouse.in | close.controls | 1 |
| NetSuiteVendor masterapplication | financial | us-east-1 | warehouse.in | vendor.new_payee | 1 |
| SalesforceCRM accountsapplication | pii.indirect | eu-west-1 | warehouse.eu | write.window | 2 |
| ZendeskSupport ticketsapplication | pii.direct | ap-south-1 | warehouse.in | pii.export_block | 2 |
| BoxExecuted contractsdocuments | pii.direct | eu-west-1 | none — never written out | pii.export_block | 1 |
| Amazon S3Product analyticswarehouse | internal | ap-south-1 | warehouse.in · warehouse.eu | pii.export_block | 1 |
| BoxPolicy handbookknowledge base | internal | eu-west-1 | warehouse.in · warehouse.eu | pii.export_block | 3 |
| WorkdayPayroll recordsapplication | pii.direct | eu-west-1 | none — never written out | pii.export_block | — |
Sources
9
none held by OpsAI
Approved sinks
2
everything else refused
Never written out
2
readable into a decision only
Direct personal data
3
strictest handling
IllustrativeThe OpsAI sample estate across 3 residencies — ap-south-1, eu-west-1, us-east-1. Residency is a property of each system, unchanged by governing access to it.
Read it by agent
A read is a grant, issued per agent and withdrawable per agent.
Sorted by source it is a data catalogue. Sorted by agent it answers the question an incident asks: what could this thing have seen?
- refund-resolverPriya Nair · Support Ops
- Order historypii.indirect
- Support ticketspii.direct
2 sources · 1 with direct personal data
- order-lookupPriya Nair · Support Ops
- Order historypii.indirect
1 source
- ap-invoice-agentRahul Menon · Finance
- General ledgerfinancial
1 source
- vendor-onboardAnita Rao · Procurement
- Vendor masterfinancial
1 source
- inventory-syncAnita Rao · Procurement
- Product analyticsinternal
1 source
- tier1-supportPriya Nair · Support Ops
- Order historypii.indirect
- Support ticketspii.direct
- Policy handbookinternal
3 sources · 1 with direct personal data
- crm-hygieneSneha Iyer · RevOps
- CRM accountspii.indirect
1 source
- claims-triageDevang Shah · Claims
- CRM accountspii.indirect
- Policy handbookinternal
2 sources
- contract-readerKabir Sen · Legal
- Executed contractspii.direct
- Policy handbookinternal
2 sources · 1 with direct personal data
Getting connected
Data
How databases, warehouses, documents and applications are reached without OpsAI becoming a copy of them.
Why an export scores high
Risk
One subject is one problem. Every row in a set is a different class of action, and the score says so.
What was actually read
Audit
Every read decided and recorded, including the refusals, with the policy version in force.
Where to start
Write down the two places your data is allowed to go.
Most organizations can name their approved destinations in a single conversation, and have never written them anywhere a system can evaluate. That list is a stronger data control than any amount of output inspection.