Skip to content

2026 04 26 data governance ai lowcode enterprise enforcement

Jump to bottom
github-actions[bot] edited this page Apr 30, 2026 · 2 revisions

How can enterprise data governance frameworks be consistently enforced within Artificial Intelligence (AI) and visual, minimal-code application environments?

Research Question

How can enterprise data governance frameworks be consistently enforced within Artificial Intelligence (AI) and visual, minimal-code application environments, specifically, how should data classification schemes, records of where data originated, how it moved, and how it was transformed, access control policies, and restrictions on sensitive data (personal, financial, regulated) be applied and enforced across all AI and low-code execution paths?

Scope

In scope:

  • Integration between enterprise data governance frameworks (data classification schemes, data catalogues, and data-lineage tools that record where data came from, where it moved, and how it was transformed) and AI plus low-code runtime environments. Definition support: https://www.microsoft.com/en-us/power-platform/products/power-apps/topics/app-development/low-code-development-guide ; https://learn.microsoft.com/en-us/purview/data-gov-classic-lineage
  • Enforcement of data classification restrictions within AI and low-code systems: ensuring that AI systems do not process data categories they are not authorised to process, and that low-code automations do not route sensitive data to unauthorised destinations
  • Data lineage in AI systems: tracking the provenance of data used for training, fine-tuning, and inference, and recording what data an AI system has processed for audit and compliance purposes
  • Access control enforcement: ensuring that AI and low-code systems can only access data they are authorised to access, consistent with the identity and access management model addressed in this item's second approach question
  • Restrictions on sensitive data: personal data covered by the General Data Protection Regulation (GDPR) and Privacy Act, financial data, regulated data categories, and how AI systems must be constrained to avoid processing, retaining, or transmitting data outside their authorised scope
  • Applicability to major enterprise data platforms (Microsoft Purview, Amazon Web Services (AWS) Glue Data Catalog, Collibra, Alation)

Out of scope:

  • Permission-safe Retrieval-Augmented Generation (RAG) architecture (covered in existing completed item 2026-04-26-permission-safe-rag-enterprise-information-architecture)
  • AI model training data governance (focus is on production deployment data governance)
  • General enterprise data governance programme design (focus is on AI/low-code-specific integration challenges)

Constraints:

  • Must address the gap between data governance as designed (in catalogues and policies) and data governance as enforced at runtime (in AI and low-code execution environments)
  • Sources should address both the data governance side and the AI/low-code enforcement mechanism side
  • Findings should be grounded in enterprise data governance platforms in common use (Microsoft Purview preferred as primary case)

Context

[inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-lowcode-governance-enforcement-architecture.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-lowcode-observability-telemetry-governance.html] Prior completed work in this repository already showed that governed Artificial Intelligence (AI) and low-code deployment fails when machine identity, enforcement points, and runtime telemetry are weak, so the unresolved problem here is how data-governance metadata becomes technically binding during execution rather than remaining catalog-only guidance. [fact; source: https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview; https://learn.microsoft.com/en-us/power-platform/admin/wp-data-loss-prevention; https://docs.aws.amazon.com/glue/latest/dg/security-lf-enable.html] The current vendor evidence also shows that runtime governance is platform-specific: some stacks expose direct policy hooks for prompts, connectors, and retrieval, while others leave catalogs and lineage separate from the actual enforcement path. [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-ai-lowcode-observability-telemetry-governance.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-lowcode-lifecycle-management.html] This item therefore provides the data-governance model needed by observability and lifecycle work, because both depend on a clear statement of which classifications, entitlements, lineage records, and sensitive-data restrictions must survive every AI and low-code execution path.

Cross-references:

  • Q2: 2026-04-26-ai-agent-identity-access-management-enterprise
  • Q4: 2026-04-26-ai-lowcode-observability-telemetry-governance
  • Q5: 2026-04-26-ai-lowcode-risk-tier-classification-controls
  • Q7: 2026-04-26-ai-lowcode-lifecycle-management
  • Q15: 2026-04-26-ai-lowcode-regulatory-compliance-alignment
  • Q16: 2026-04-26-ai-agent-control-plane-architecture-enterprise

Approach

  1. Data governance integration gap analysis: Identify the specific points at which enterprise data governance frameworks (classification, lineage, access control) are not enforced in AI and low-code systems, i.e. the gap between what the data governance framework specifies and what is actually enforced at runtime in AI inference and low-code workflow execution.
  2. Data classification enforcement mechanisms: Review how data classification metadata (sensitivity labels, data categories) can be propagated to and enforced at AI and low-code runtime boundaries, for example Microsoft Purview sensitivity labels in Azure AI Foundry and data classification enforcement in Power Automate.
  3. Lineage tracking in AI systems: Assess what data lineage information can be captured for AI systems, including training data provenance, fine-tuning data, prompt content, and retrieved documents in Retrieval-Augmented Generation (RAG), and what tooling supports this (MLflow, Azure ML, Weights & Biases, dbt lineage).
  4. Sensitive data restrictions: For each sensitive data category (personal data under GDPR, financial data under applicable regulations, regulated industry data), define what restrictions on AI and low-code processing are required, and how those restrictions can be enforced at the data access, model runtime, and output layers.
  5. Platform capability assessment: Assess how Microsoft Purview, AWS Glue Data Catalog, Collibra, and Alation support enforcement of data governance within AI and low-code environments, where native integration exists and where compensating controls are required.
  6. Synthesis: Produce a data governance enforcement model for AI and low-code systems, specifying enforcement points, required controls per data classification tier, and tooling options.

Sources

Related

Research Skill Output

(Full output from running the research skill - retained verbatim in the completed item. Sections 0 to 5 are the investigation, and section 6 seeds the Findings section below.)

§0 Initialise

  • [fact; source: https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview; https://learn.microsoft.com/en-us/power-platform/admin/wp-data-loss-prevention; https://docs.aws.amazon.com/glue/latest/dg/security-lf-enable.html] Research question restated: what governance architecture lets an enterprise apply data classification, lineage, access control, and sensitive-data restrictions consistently across Artificial Intelligence (AI) prompts, retrieval, model calls, connectors, automations, and outputs instead of leaving those controls trapped inside catalogs and policy documents?
  • [fact; source: https://learn.microsoft.com/en-us/purview/sensitivity-labels; https://learn.microsoft.com/en-us/purview/data-gov-classic-lineage; https://learn.microsoft.com/en-us/power-platform/admin/wp-data-loss-prevention; https://docs.aws.amazon.com/datazone/latest/userguide/datazone-data-lineage.html; https://mlflow.org/docs/latest/ml/dataset/; https://mlflow.org/docs/latest/genai/concepts/trace/] Scope confirmed: the investigation covers classification propagation, runtime authorization, low-code connector policy, lineage capture for enterprise data and AI execution, sensitive-data restrictions, and platform capability across Microsoft Purview, Amazon Web Services (AWS) Glue Data Catalog, Collibra, Alation, and MLflow.
  • [fact; source: https://davidamitchell.github.io/Research/research/2026-04-26-ai-agent-identity-access-management-enterprise.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-lowcode-governance-enforcement-architecture.html; https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-lowcode-observability-telemetry-governance.html; https://davidamitchell.github.io/Research/research/2026-04-26-ai-lowcode-regulatory-compliance-alignment.html] Prior work cross-reference: prior completed items already established that governed deployment depends on first-class machine identity, explicit enforcement points, permission-safe retrieval, attributable telemetry, and regulator-visible evidence, so this item narrows the problem to the data-governance layer those controls must consume.
  • [fact; source: https://learn.microsoft.com/en-us/purview/ai-agents; https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview; https://docs.aws.amazon.com/lake-formation/latest/dg/tag-based-access-control.html] Constraint note: the reviewed platforms do not expose identical native enforcement surfaces, so the answer must distinguish between metadata publication, workflow governance, and actual runtime blocking.
  • [fact; source: https://github.com/davidamitchell/Research/blob/main/research-prompt.md] Skill fallback note: .github/skills/research/SKILL.md was absent in this checkout, so the repository fallback process in research-prompt.md was used for section structure and review rules.
  • [fact; source: https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview; https://docs.aws.amazon.com/glue/latest/dg/security-lf-enable.html; https://productresources.collibra.com/docs/collibra/latest/Content/AIGovernance/co_about-ai-governance.htm] Output format confirmed: knowledge, specifically a runtime data-governance enforcement model and platform assessment for enterprise AI and low-code systems.

§1 Question Decomposition

  • Root question: What model makes cataloged governance policies technically binding across AI and low-code execution paths?
  • A. Governance-to-runtime translation
    • A1. Which reviewed platforms publish classification or governance metadata?
    • A2. Which reviewed platforms can convert that metadata into runtime allow, deny, or filter decisions?
    • A3. Where does policy remain advisory unless another enforcement surface consumes it?
  • B. Classification and access control
    • B1. How do labels, tags, and connector policies identify sensitive or restricted data?
    • B2. Which mechanisms enforce user or workload-specific authorization at query or execution time?
    • B3. Which mechanisms can stop already-deployed low-code artifacts from continuing to run after policy changes?
  • C. Lineage
    • C1. Which tools capture data-estate lineage for sources, transformations, and downstream assets?
    • C2. Which tools capture runtime lineage for prompts, retrieved documents, tool calls, and outputs?
    • C3. What lineage gaps remain if an enterprise uses only a data catalog or only AI tracing?
  • D. Sensitive-data restrictions
    • D1. What restrictions follow from General Data Protection Regulation (GDPR) Article 5 and Australian Prudential Regulation Authority (APRA) CPG 235 for personal, financial, and regulated data?
    • D2. At which layers must those restrictions be enforced: access, retrieval, model input, low-code connector, output, or retention?
  • E. Platform assessment
    • E1. What is the Microsoft pattern across Purview, Foundry, Azure AI Search, and Power Platform?
    • E2. What is the AWS pattern across Glue Data Catalog, Lake Formation, and DataZone?
    • E3. What do Collibra and Alation officially expose as governance versus runtime-control capabilities?
  • F. Synthesis
    • F1. Which control model is necessary for consistent enterprise enforcement?
    • F2. Which platforms offer native enforcement and where are compensating controls required?

§2 Investigation

  • Source access and replacement notes

  • [fact; source: https://handbook.apra.gov.au/node/115112] Access note: the seeded APRA PDF URL returned 404 during this session and was replaced with the live APRA Handbook node for CPG 235.

  • [fact; source: https://github.com/davidamitchell/Research/blob/main/research-prompt.md] Access note: .github/skills/research/SKILL.md was absent, so the repository fallback prompt was used.

  • [fact; source: https://productresources.collibra.com/docs/collibra/latest/Content/AIGovernance/co_about-ai-governance.htm; https://productresources.collibra.com/docs/collibra/dqc/latest/Content/DataQuality/DQAdmin/co_sensitive-labels.htm; https://www.alation.com/blog/data-governance-for-ai-agents-what-you-need-to-know/] Access note: Collibra evidence in this session came from official product documentation, while Alation evidence came from official vendor blog material rather than product-reference documentation.

  • A. Catalog metadata versus runtime enforcement

  • [fact; source: https://learn.microsoft.com/en-us/purview/sensitivity-labels] Microsoft Purview sensitivity labels classify content in clear-text metadata, stay with the content, can enforce encryption and other protection settings, and can extend to SharePoint libraries, Microsoft 365 Copilot, Power BI, and Microsoft Purview Data Map assets.

  • [fact; source: https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview] Microsoft says custom AI apps only get Purview runtime governance when developers use native Microsoft Foundry integration, Microsoft Purview Application Programming Interface (API) calls, or Microsoft Agent Framework middleware to send prompts and responses to Purview and enforce Data Loss Prevention (DLP) behavior.

  • [fact; source: https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview] The same Microsoft guidance says oversharing prevention depends on either Microsoft Purview APIs or Azure AI Search sensitivity-label indexing, because Azure AI Search checks label metadata at query time and returns only results the requesting user is allowed to access.

  • [fact; source: https://learn.microsoft.com/en-us/power-platform/admin/wp-data-loss-prevention] Power Platform data policies let administrators control certified, custom, virtual, and Model Context Protocol (MCP) connectors and apply restrictions that affect both maker design-time behavior and runtime execution of apps, flows, and chatbots.

  • [fact; source: https://learn.microsoft.com/en-us/power-platform/admin/wp-data-loss-prevention] When Power Platform policy changes detect a violation, the platform can suspend or quarantine an app, flow, or chatbot, disable blocked connections, and cause blocked resources to fail at runtime, although full enforcement latency can reach 24 hours in large estates.

  • [inference; source: https://learn.microsoft.com/en-us/purview/sensitivity-labels; https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview; https://learn.microsoft.com/en-us/power-platform/admin/wp-data-loss-prevention] Catalog metadata is therefore necessary but insufficient on its own, because consistent enforcement only appears when the runtime, retrieval layer, or connector engine is explicitly built to consume labels, tags, or policies during execution.

  • B. Classification propagation and sensitive-data restrictions

  • [fact; source: https://learn.microsoft.com/en-us/purview/ai-agents] Microsoft Purview documents information-protection and compliance-management support for Microsoft 365 Copilot agents, Copilot Studio agents, Entra-registered agents, and Microsoft Foundry agents, with Foundry and Copilot Studio surfaces explicitly supporting data classification, sensitivity labels, and DLP.

  • [fact; source: https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ai-agents/governance-security-across-organization] Microsoft's Cloud Adoption Framework says agents should be granted access only to the specific data sources required for their function, should inherit the user's permissions when acting on behalf of a user, and should apply Purview DLP policies and sensitivity labels to protect data.

  • [fact; source: https://gdpr-info.eu/art-5-gdpr/] GDPR Article 5 requires personal data to be processed lawfully, fairly, and transparently, collected for specified purposes, limited to what is necessary, kept accurate, retained no longer than necessary, and protected for integrity and confidentiality.

  • [fact; source: https://handbook.apra.gov.au/node/115112] APRA CPG 235 treats data risk as a subset of operational risk, says data includes structured and unstructured forms, and lists disclosure of sensitive data and inaccurate or unavailable data as examples of risk that can cause regulatory or business failure.

  • [inference; source: https://gdpr-info.eu/art-5-gdpr/; https://handbook.apra.gov.au/node/115112; https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview] Personal, financial, and regulated data therefore need restrictions that are stricter than simple discoverability labels: the runtime must minimize unnecessary processing, block unauthorized disclosure before prompt submission or connector transmission, and preserve auditable controls over retention and downstream sharing.

  • C. Lineage requirements for enterprise data and AI execution

  • [fact; source: https://learn.microsoft.com/en-us/purview/data-gov-classic-lineage] Microsoft Purview lineage captures movement, transformation, and operational metadata across storage, processing, and visualization systems, and can represent entity-level, column-level, and process-execution-status lineage.

  • [fact; source: https://docs.aws.amazon.com/datazone/latest/userguide/datazone-data-lineage.html] Amazon DataZone lineage is OpenLineage-compatible, can automatically capture lineage from AWS Glue and Amazon Redshift resources, versions lineage events over time, and uses column-level lineage to show where sensitive data such as Personally Identifiable Information (PII) is stored and processed.

  • [fact; source: https://mlflow.org/docs/latest/ml/dataset/] MLflow dataset tracking records dataset source, schema, profile, digest, and linked lineage back to the original location, including file URLs, storage buckets, or database sources.

  • [fact; source: https://mlflow.org/docs/latest/genai/concepts/trace/] MLflow tracing records request and response previews, retrieved documents, tool-call parameters, span hierarchies, execution duration, and trace metadata for Large Language Models (LLMs) and AI-agent workflows.

  • [inference; source: https://learn.microsoft.com/en-us/purview/data-gov-classic-lineage; https://docs.aws.amazon.com/datazone/latest/userguide/datazone-data-lineage.html; https://mlflow.org/docs/latest/ml/dataset/; https://mlflow.org/docs/latest/genai/concepts/trace/] Enterprise AI lineage needs two linked layers, one for data-estate provenance and transformation, and another for runtime prompt, retrieval, tool, and output events, because neither a traditional catalog nor AI traces alone can explain the full decision path.

  • D. AWS Glue Data Catalog and Lake Formation

  • [fact; source: https://docs.aws.amazon.com/whitepapers/latest/data-classification/data-classification-overview.html] AWS's data-classification guidance says classification starts by establishing a catalog, grouping data types into classification levels, labeling assets, documenting handling rules, and continuously monitoring usage and access patterns.

  • [fact; source: https://docs.aws.amazon.com/whitepapers/latest/data-classification/data-classification-overview.html] The same AWS guidance says the Glue Data Catalog stores, annotates, and shares metadata while providing schema change tracking and data-access controls as part of a classification program.

  • [fact; source: https://docs.aws.amazon.com/glue/latest/dg/security-lf-enable.html] AWS Glue 5.0 and higher can use AWS Lake Formation to apply fine-grained access control (FGAC) on cataloged tables backed by Amazon Simple Storage Service (Amazon S3), including table, row, column, and cell-level read controls inside AWS Glue Spark jobs.

  • [fact; source: https://docs.aws.amazon.com/glue/latest/dg/security-lf-enable.html] AWS also says Lake Formation permissions alone are not enough, because the runtime role still needs Identity and Access Management (IAM) permissions for AWS Glue and Lake Formation Application Programming Interfaces (APIs).

  • [fact; source: https://docs.aws.amazon.com/lake-formation/latest/dg/tag-based-access-control.html] Lake Formation tag-based access control defines permissions by attaching Lake Formation tags (LF-Tags), such as classification=restricted, to Data Catalog resources and granting principals access when tag values match.

  • [inference; source: https://docs.aws.amazon.com/whitepapers/latest/data-classification/data-classification-overview.html; https://docs.aws.amazon.com/glue/latest/dg/security-lf-enable.html; https://docs.aws.amazon.com/lake-formation/latest/dg/tag-based-access-control.html; https://docs.aws.amazon.com/datazone/latest/userguide/datazone-data-lineage.html] The AWS pattern is therefore a composed model: Glue Data Catalog publishes metadata, Lake Formation and IAM enforce access, and DataZone or other lineage services record data movement, so the catalog alone is not the runtime enforcement point.

  • E. Collibra and Alation capability assessment

  • [fact; source: https://productresources.collibra.com/docs/collibra/latest/Content/AIGovernance/co_about-ai-governance.htm] Collibra AI Governance provides a centralized repository for AI agents, models, and use cases, positions asset pages as the single source of truth, and records training and inference dataset categories, sources, quality, and lineage alongside approvals and stakeholder roles.

  • [fact; source: https://productresources.collibra.com/docs/collibra/latest/Content/AIGovernance/co_about-ai-governance.htm] Collibra also documents supported integrations for AWS Bedrock, Azure AI Foundry, Azure Machine Learning, Databricks, Google Vertex AI, and MLflow, which shows a design centered on registry, workflow, and lifecycle integration rather than on a single built-in runtime enforcement engine.

  • [fact; source: https://productresources.collibra.com/docs/collibra/dqc/latest/Content/DataQuality/DQAdmin/co_sensitive-labels.htm] Collibra's sensitive-label documentation says administrators can manage labels such as out-of-the-box Personally Identifiable Information, Material Non-Public Information, Protected Health Information, Controlled Unclassified Information, and Payment Card Industry labels, and that associated data-class checks are run when those labels are attached to a data-quality job.

  • [fact; source: https://www.alation.com/blog/data-governance-for-ai-agents-what-you-need-to-know/] Alation says its catalog supports metadata management, data lineage, compliance tracking, centralized policy management, masking and anonymization practices, version control, and role-based access permissions for AI-agent governance.

  • [inference; source: https://productresources.collibra.com/docs/collibra/latest/Content/AIGovernance/co_about-ai-governance.htm; https://productresources.collibra.com/docs/collibra/dqc/latest/Content/DataQuality/DQAdmin/co_sensitive-labels.htm; https://www.alation.com/blog/data-governance-for-ai-agents-what-you-need-to-know/] The reviewed Collibra and Alation materials show strong governance, workflow, lineage, and classification surfaces, but they do not show standalone runtime blocking for prompts, retrieval, or low-code execution on the same terms as Power Platform DLP or Lake Formation FGAC, so compensating controls are still required in the consuming runtime.

  • F. Control model implied by the evidence

  • [inference; source: https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview; https://learn.microsoft.com/en-us/power-platform/admin/wp-data-loss-prevention; https://docs.aws.amazon.com/glue/latest/dg/security-lf-enable.html; https://mlflow.org/docs/latest/genai/concepts/trace/] A workable enterprise model has four linked layers: authoritative metadata in the catalog, policy translation into executable rules, runtime enforcement in retrieval or connector surfaces, and lineage plus telemetry that proves the controls operated.

  • [inference; source: https://learn.microsoft.com/en-us/purview/sensitivity-labels; https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ai-agents/governance-security-across-organization; https://docs.aws.amazon.com/lake-formation/latest/dg/tag-based-access-control.html] Classification only matters when labels or tags survive into access decisions tied to a requesting user or workload identity, because that is what converts "confidential" or "restricted" from descriptive metadata into an allow or deny condition.

  • [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html; https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview; https://docs.aws.amazon.com/glue/latest/dg/security-lf-enable.html] Copied indexes, exports, or cached data stores are highest-risk execution paths for restricted data unless they preserve live or near-live entitlement checks, because prior completed repository research already showed copied permission models become technically fragile when permissions or sharing patterns change.

§3 Reasoning

  • [inference; source: https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview; https://learn.microsoft.com/en-us/power-platform/admin/wp-data-loss-prevention; https://docs.aws.amazon.com/glue/latest/dg/security-lf-enable.html] The decisive distinction in the evidence is not "which catalog is best" but "which execution surface actually consumes catalog policy at runtime," so the synthesis favors composed control chains over catalog-only answers.
  • [inference; source: https://learn.microsoft.com/en-us/purview/data-gov-classic-lineage; https://docs.aws.amazon.com/datazone/latest/userguide/datazone-data-lineage.html; https://mlflow.org/docs/latest/genai/concepts/trace/] Lineage had to be separated into data-estate lineage and AI runtime lineage because the reviewed sources divide those functions across different tools and no single source claimed to cover both comprehensively.
  • [inference; source: https://gdpr-info.eu/art-5-gdpr/; https://handbook.apra.gov.au/node/115112; https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview] Sensitive-data restrictions were derived by combining regulatory obligations with platform enforcement hooks, which means the final model emphasizes minimization, least privilege, and oversharing prevention rather than unrestricted reuse of cataloged data.
  • [inference; source: https://productresources.collibra.com/docs/collibra/latest/Content/AIGovernance/co_about-ai-governance.htm; https://www.alation.com/blog/data-governance-for-ai-agents-what-you-need-to-know/] Vendor positioning from governance-catalog vendors was weighed below primary platform runtime documentation whenever the claim concerned actual blocking behavior.

§4 Consistency Check

  • [fact; source: https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview; https://learn.microsoft.com/en-us/power-platform/admin/wp-data-loss-prevention; https://docs.aws.amazon.com/glue/latest/dg/security-lf-enable.html] Internal consistency check passed for the main conclusion that runtime enforcement requires an enforcement surface which actively consumes metadata, because Microsoft, Power Platform, and AWS each document that enforcement occurs in middleware, connector engines, query-time filters, or Lake Formation-backed job execution rather than in the catalog record alone.
  • [fact; source: https://learn.microsoft.com/en-us/purview/data-gov-classic-lineage; https://docs.aws.amazon.com/datazone/latest/userguide/datazone-data-lineage.html; https://mlflow.org/docs/latest/genai/concepts/trace/] Internal consistency check also passed for the lineage conclusion, because the evidence cleanly splits enterprise data lineage from runtime AI trace lineage without contradiction.
  • [inference; source: https://productresources.collibra.com/docs/collibra/latest/Content/AIGovernance/co_about-ai-governance.htm; https://www.alation.com/blog/data-governance-for-ai-agents-what-you-need-to-know/] The main unresolved area is the exact runtime reach of Collibra and Alation, so those claims remain limited to workflow, lineage, registry, and vendor-stated policy capabilities.

§5 Depth and Breadth Expansion

  • [inference; source: https://www.nist.gov/privacy-framework; https://gdpr-info.eu/art-5-gdpr/; https://handbook.apra.gov.au/node/115112] From a regulatory and privacy lens, the important pattern is that governance metadata has to translate into practical data-minimization and disclosure-prevention controls, because both the National Institute of Standards and Technology (NIST) Privacy Framework and prudential guidance treat data misuse as an operational and compliance risk rather than as a documentation failure.
  • [inference; source: https://learn.microsoft.com/en-us/power-platform/admin/wp-data-loss-prevention; https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ai-agents/governance-security-across-organization] From a behavioral and operating-model lens, low-code estates need centralized connector policy and the ability to disable already-created artifacts, otherwise maker autonomy will outrun the formal governance model.
  • [inference; source: https://mlflow.org/docs/latest/genai/concepts/trace/; https://davidamitchell.github.io/Research/research/2026-04-26-ai-lowcode-observability-telemetry-governance.html] From a technical lens, AI runtime governance is inseparable from observability, because prompt, retrieval, and tool-call traces are the only way to prove what data an agent actually processed.
  • [inference; source: https://docs.aws.amazon.com/lake-formation/latest/dg/tag-based-access-control.html; https://learn.microsoft.com/en-us/purview/sensitivity-labels] From an architectural lens, attribute-linked authorization is the scalable pattern across platforms, whether the attribute is a sensitivity label, a catalog tag, or a connector-policy group.

§6 Synthesis

  • Executive summary:

  • [inference; source: https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview; https://learn.microsoft.com/en-us/power-platform/admin/wp-data-loss-prevention; https://docs.aws.amazon.com/glue/latest/dg/security-lf-enable.html] Enterprise data governance is only consistently enforceable in AI and low-code systems when catalog metadata is translated into runtime authorization, connector, retrieval, and output controls that execute against the invoking identity.

  • [fact; source: https://learn.microsoft.com/en-us/purview/sensitivity-labels; https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview; https://learn.microsoft.com/en-us/power-platform/admin/wp-data-loss-prevention] The reviewed Microsoft documentation shows a native chain from classification metadata to runtime control, because Purview labels persist with content, Azure AI Search can enforce label-aware query filtering, and Power Platform data policies can suspend or disable violating low-code assets at runtime.

  • [inference; source: https://docs.aws.amazon.com/glue/latest/dg/security-lf-enable.html; https://docs.aws.amazon.com/lake-formation/latest/dg/tag-based-access-control.html; https://docs.aws.amazon.com/datazone/latest/userguide/datazone-data-lineage.html] AWS reaches similar control outcomes through a composed pattern, with Glue Data Catalog for metadata, Lake Formation and Identity and Access Management (IAM) for access enforcement, and DataZone for lineage, which means the catalog itself is not the sole enforcement endpoint.

  • [inference; source: https://productresources.collibra.com/docs/collibra/latest/Content/AIGovernance/co_about-ai-governance.htm; https://www.alation.com/blog/data-governance-for-ai-agents-what-you-need-to-know/; https://mlflow.org/docs/latest/genai/concepts/trace/] Collibra, Alation, and MLflow are valuable governance, lineage, and trace layers, but they do not remove the need for explicit runtime controls in AI applications, retrieval layers, connector engines, and low-code orchestration.

  • Key findings:

    1. [high] [inference; source: https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview; https://learn.microsoft.com/en-us/power-platform/admin/wp-data-loss-prevention; https://docs.aws.amazon.com/glue/latest/dg/security-lf-enable.html] Enterprise data governance frameworks are not self-enforcing in AI and low-code environments, because every reviewed platform requires a separate runtime component such as middleware, query-time filters, connector policy, or Lake Formation-backed execution to turn catalog metadata into actual allow, deny, or filter decisions.
    1. [high] [fact; source: https://learn.microsoft.com/en-us/purview/sensitivity-labels; https://learn.microsoft.com/en-us/purview/ai-agents; https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview] Microsoft documentation shows a native chain from classification metadata to runtime control, because sensitivity labels persist with content, supported agent surfaces inherit information-protection controls, and Microsoft documents APIs plus Azure AI Search integrations that honor labels and prevent oversharing during retrieval and response generation.
    1. [medium] [fact; source: https://learn.microsoft.com/en-us/power-platform/admin/wp-data-loss-prevention] Power Platform data policies are a genuine runtime governance surface for low-code systems, because they can block certified, custom, virtual, and Model Context Protocol (MCP) connectors, suspend or quarantine violating apps and flows, disable blocked connections, and force blocked resources to fail when they execute.
    1. [high] [inference; source: https://learn.microsoft.com/en-us/purview/data-gov-classic-lineage; https://docs.aws.amazon.com/datazone/latest/userguide/datazone-data-lineage.html; https://mlflow.org/docs/latest/genai/concepts/trace/] AI data governance requires two linked lineage layers, one for enterprise data movement and transformation and another for runtime prompts, retrieved documents, tool calls, and outputs, because no reviewed catalog product alone captured the full execution path of an AI or low-code workflow.
    1. [high] [fact; source: https://docs.aws.amazon.com/whitepapers/latest/data-classification/data-classification-overview.html; https://docs.aws.amazon.com/glue/latest/dg/security-lf-enable.html; https://docs.aws.amazon.com/lake-formation/latest/dg/tag-based-access-control.html] AWS Glue Data Catalog can support classification and metadata sharing, but consistent enforcement depends on coupling catalog resources to Lake Formation tags and permissions plus IAM rights, so the effective enforcement point sits in Lake Formation-governed execution rather than in the catalog entry itself.
    1. [medium] [inference; source: https://productresources.collibra.com/docs/collibra/latest/Content/AIGovernance/co_about-ai-governance.htm; https://productresources.collibra.com/docs/collibra/dqc/latest/Content/DataQuality/DQAdmin/co_sensitive-labels.htm; https://www.alation.com/blog/data-governance-for-ai-agents-what-you-need-to-know/] Collibra and Alation are best understood as governance-control-plane products for registry, workflow, classification, and lineage, not as independent runtime enforcement layers, because the reviewed materials emphasize documentation, lifecycle, labels, and compliance tracking more than direct prompt, retrieval, or connector blocking.
    1. [medium] [inference; source: https://gdpr-info.eu/art-5-gdpr/; https://handbook.apra.gov.au/node/115112; https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ai-agents/governance-security-across-organization; https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview] Personal, financial, and other regulated data should default to live entitlement checks, least-privilege connector access, DLP inspection before model input and outbound transmission, and tightly bounded retention, because privacy and prudential guidance treat unnecessary processing or disclosure of sensitive data as a control failure rather than as a mere governance exception.
    1. [medium] [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html; https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview; https://docs.aws.amazon.com/glue/latest/dg/security-lf-enable.html] Restricted and permission-variable data should avoid static copied indexes, exports, or cached memories unless entitlements are synchronized at query time or execution time, because prior repository research and current vendor documentation both show that copied permission models become fragile when access rights or sharing boundaries change.

  • Evidence map:

  • | Claim | Source | Confidence | Notes |

  • |---|---|---|---|

  • | [inference] Catalog metadata is not self-enforcing; runtime controls must consume it. | https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview ; https://learn.microsoft.com/en-us/power-platform/admin/wp-data-loss-prevention ; https://docs.aws.amazon.com/glue/latest/dg/security-lf-enable.html | high | Cross-platform convergence on separate enforcement surfaces. |

  • | [fact] Microsoft Purview offers label persistence, supported AI-agent protection, and label-aware retrieval controls. | https://learn.microsoft.com/en-us/purview/sensitivity-labels ; https://learn.microsoft.com/en-us/purview/ai-agents ; https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview | high | The reviewed Microsoft sources describe an end-to-end Microsoft-native metadata-to-control chain. |

  • | [fact] Power Platform DLP can block connectors and stop violating low-code assets at runtime. | https://learn.microsoft.com/en-us/power-platform/admin/wp-data-loss-prevention | medium | Includes design-time and runtime effects plus propagation latency. |

  • | [inference] AI governance needs both catalog lineage and runtime trace lineage. | https://learn.microsoft.com/en-us/purview/data-gov-classic-lineage ; https://docs.aws.amazon.com/datazone/latest/userguide/datazone-data-lineage.html ; https://mlflow.org/docs/latest/genai/concepts/trace/ | high | Catalog lineage and runtime traces cover different parts of the control path. |

  • | [fact] AWS enforcement depends on Glue metadata plus Lake Formation and IAM controls. | https://docs.aws.amazon.com/whitepapers/latest/data-classification/data-classification-overview.html ; https://docs.aws.amazon.com/glue/latest/dg/security-lf-enable.html ; https://docs.aws.amazon.com/lake-formation/latest/dg/tag-based-access-control.html | high | Data catalog, policy tags, and execution permissions are separate but composable. |

  • | [inference] Collibra and Alation mainly provide governance-plane capabilities, not standalone runtime blocking. | https://productresources.collibra.com/docs/collibra/latest/Content/AIGovernance/co_about-ai-governance.htm ; https://productresources.collibra.com/docs/collibra/dqc/latest/Content/DataQuality/DQAdmin/co_sensitive-labels.htm ; https://www.alation.com/blog/data-governance-for-ai-agents-what-you-need-to-know/ | medium | Collibra evidence is stronger than Alation because it comes from product documentation. |

  • | [inference] Sensitive and regulated data should use live checks, DLP, and bounded retention. | https://gdpr-info.eu/art-5-gdpr/ ; https://handbook.apra.gov.au/node/115112 ; https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ai-agents/governance-security-across-organization ; https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview | medium | Derived by combining regulatory duties with documented technical control hooks. |

  • | [inference] Copied permission stores are fragile for restricted and frequently changing data. | https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html ; https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview ; https://docs.aws.amazon.com/glue/latest/dg/security-lf-enable.html | medium | Prior repository research sharpens the current platform evidence. |

  • Assumptions:

  • [assumption; source: https://www.alation.com/blog/data-governance-for-ai-agents-what-you-need-to-know/] Alation capability claims are treated as vendor-positioning evidence rather than as independently verified product mechanics. Justification: the official Alation source reviewed in this session was a vendor blog, not a product-reference page.

  • [assumption; source: https://learn.microsoft.com/en-us/purview/sensitivity-labels; https://docs.aws.amazon.com/lake-formation/latest/dg/tag-based-access-control.html] The synthesized tier model in this item assumes enterprises map local labels or tags into a common operating pattern of public, internal, confidential, and restricted or regulated handling. Justification: the reviewed sources describe labels and tags but do not prescribe a universal four-tier taxonomy across vendors.

  • Analysis:

  • [inference; source: https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview; https://learn.microsoft.com/en-us/power-platform/admin/wp-data-loss-prevention; https://docs.aws.amazon.com/glue/latest/dg/security-lf-enable.html] The evidence was weighted toward platform documentation that described where decisions are actually executed, because the research question is about enforcement rather than about catalog completeness or governance-process maturity.

  • [inference; source: https://learn.microsoft.com/en-us/purview/sensitivity-labels; https://docs.aws.amazon.com/lake-formation/latest/dg/tag-based-access-control.html] Across vendors, the scalable pattern is attribute-linked authorization: a label or tag captures classification, and a runtime surface uses that attribute to decide whether a request, query, tool call, or connector action can proceed.

  • [inference; source: https://learn.microsoft.com/en-us/purview/data-gov-classic-lineage; https://docs.aws.amazon.com/datazone/latest/userguide/datazone-data-lineage.html; https://mlflow.org/docs/latest/genai/concepts/trace/] Lineage had to be split into estate lineage and runtime lineage because governance teams need both provenance of source data and proof of what a specific AI or low-code execution actually touched.

  • [inference; source: https://learn.microsoft.com/en-us/purview/sensitivity-labels; https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ai-agents/governance-security-across-organization; https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview; https://docs.aws.amazon.com/lake-formation/latest/dg/tag-based-access-control.html] A practical tier model is: public data can use ordinary authorization and standard logging; internal data adds approved-connector and ownership controls; confidential data adds label-aware retrieval, runtime traceability, and restricted outbound connectors; restricted or regulated data adds live entitlement checks, pre-input and pre-output DLP inspection, and a default ban on static copied stores unless explicitly approved.

  • [inference; source: https://gdpr-info.eu/art-5-gdpr/; https://handbook.apra.gov.au/node/115112; https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html] The practical trade-off is between the implementation convenience of copied stores and the control fidelity of live checks, with higher-sensitivity and more permission-volatile data pushing strongly toward live checks or label-aware retrieval over static copies.

  • Risks, gaps, uncertainties:

  • [fact; source: https://www.alation.com/blog/data-governance-for-ai-agents-what-you-need-to-know/] The Alation evidence base in this item is thinner than the Microsoft, AWS, and Collibra evidence base because it relied on official vendor blog material rather than product-reference documentation.

  • [fact; source: https://handbook.apra.gov.au/node/115112] The seeded APRA PDF URL was dead during this session, although the official APRA Handbook page exposed the necessary guidance content.

  • [fact; source: https://www.nist.gov/privacy-framework] The National Institute of Standards and Technology (NIST) Privacy Framework page establishes the framework's purpose and voluntary status, but this item did not rely on detailed subcategory mapping from the framework core because the fetched Portable Document Format (PDF) content was not cleanly machine-readable in this environment.

  • [inference; source: https://learn.microsoft.com/en-us/purview/ai-agents; https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview] Some Microsoft Purview AI pages are partially authorization-gated in rendered form, so this item limits itself to claims that were visible in the accessible page content.

  • Open questions:

  • [inference; source: https://productresources.collibra.com/docs/collibra/latest/Content/AIGovernance/co_about-ai-governance.htm; https://www.alation.com/blog/data-governance-for-ai-agents-what-you-need-to-know/] Which runtime integrations do Collibra and Alation customers actually deploy most often to convert catalog policy into AI prompt-time or low-code execution-time controls?

  • [inference; source: https://learn.microsoft.com/en-us/power-platform/admin/wp-data-loss-prevention] How should enterprises design compensating controls for the documented Power Platform policy-propagation window when emergency connector blocking is required faster than the normal propagation cycle?

  • [inference; source: https://mlflow.org/docs/latest/genai/concepts/trace/; https://learn.microsoft.com/en-us/purview/data-gov-classic-lineage] What is the cleanest enterprise pattern for joining catalog lineage graphs with AI runtime traces so that a single investigation can traverse from source record to generated output without manual correlation?

§7 Recursive Review

  • [fact; source: https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview; https://learn.microsoft.com/en-us/power-platform/admin/wp-data-loss-prevention; https://docs.aws.amazon.com/glue/latest/dg/security-lf-enable.html] Recursive review result: the answer stayed within the cited evidence by separating catalog capability from runtime enforcement and by labeling synthesized control recommendations as inferences rather than as direct vendor guarantees.
  • [fact; source: https://learn.microsoft.com/en-us/purview/data-gov-classic-lineage; https://docs.aws.amazon.com/datazone/latest/userguide/datazone-data-lineage.html; https://mlflow.org/docs/latest/genai/concepts/trace/] Recursive review result: every conclusion about lineage remained aligned with the reviewed source split between data-estate lineage and runtime execution traces.
  • [fact; source: https://productresources.collibra.com/docs/collibra/latest/Content/AIGovernance/co_about-ai-governance.htm; https://www.alation.com/blog/data-governance-for-ai-agents-what-you-need-to-know/] Recursive review result: Collibra and Alation claims were intentionally narrowed to the documented governance-plane capabilities because stronger runtime assertions were not justified by the material reviewed.

Findings

Executive Summary

[inference; source: https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview; https://learn.microsoft.com/en-us/power-platform/admin/wp-data-loss-prevention; https://docs.aws.amazon.com/glue/latest/dg/security-lf-enable.html] Enterprise data governance is only consistently enforceable in AI and low-code systems when catalog metadata is translated into runtime authorization, connector, retrieval, and output controls that execute against the invoking identity. [fact; source: https://learn.microsoft.com/en-us/purview/sensitivity-labels; https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview; https://learn.microsoft.com/en-us/power-platform/admin/wp-data-loss-prevention] The reviewed Microsoft documentation shows a native chain from classification metadata to runtime control, because Purview labels persist with content, Azure AI Search can enforce label-aware query filtering, and Power Platform data policies can suspend or disable violating low-code assets at runtime. [inference; source: https://docs.aws.amazon.com/glue/latest/dg/security-lf-enable.html; https://docs.aws.amazon.com/lake-formation/latest/dg/tag-based-access-control.html; https://docs.aws.amazon.com/datazone/latest/userguide/datazone-data-lineage.html] AWS reaches similar control outcomes through a composed pattern, with Glue Data Catalog for metadata, Lake Formation and IAM for access enforcement, and DataZone for lineage, which means the catalog itself is not the sole enforcement endpoint. [inference; source: https://productresources.collibra.com/docs/collibra/latest/Content/AIGovernance/co_about-ai-governance.htm; https://www.alation.com/blog/data-governance-for-ai-agents-what-you-need-to-know/; https://mlflow.org/docs/latest/genai/concepts/trace/] Collibra, Alation, and MLflow are valuable governance, lineage, and trace layers, but they do not remove the need for explicit runtime controls in AI applications, retrieval layers, connector engines, and low-code orchestration.

Key Findings

  1. [high] [inference; source: https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview; https://learn.microsoft.com/en-us/power-platform/admin/wp-data-loss-prevention; https://docs.aws.amazon.com/glue/latest/dg/security-lf-enable.html] Enterprise data governance frameworks are not self-enforcing in AI and low-code environments, because every reviewed platform requires a separate runtime component such as middleware, query-time filters, connector policy, or Lake Formation-backed execution to turn catalog metadata into actual allow, deny, or filter decisions.
  2. [high] [fact; source: https://learn.microsoft.com/en-us/purview/sensitivity-labels; https://learn.microsoft.com/en-us/purview/ai-agents; https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview] Microsoft documentation shows a native chain from classification metadata to runtime control, because sensitivity labels persist with content, supported agent surfaces inherit information-protection controls, and Microsoft documents APIs plus Azure AI Search integrations that honor labels and prevent oversharing during retrieval and response generation.
  3. [medium] [fact; source: https://learn.microsoft.com/en-us/power-platform/admin/wp-data-loss-prevention] Power Platform data policies are a genuine runtime governance surface for low-code systems, because they can block certified, custom, virtual, and Model Context Protocol (MCP) connectors, suspend or quarantine violating apps and flows, disable blocked connections, and force blocked resources to fail when they execute.
  4. [high] [inference; source: https://learn.microsoft.com/en-us/purview/data-gov-classic-lineage; https://docs.aws.amazon.com/datazone/latest/userguide/datazone-data-lineage.html; https://mlflow.org/docs/latest/genai/concepts/trace/] AI data governance requires two linked lineage layers, one for enterprise data movement and transformation and another for runtime prompts, retrieved documents, tool calls, and outputs, because no reviewed catalog product alone captured the full execution path of an AI or low-code workflow.
  5. [high] [fact; source: https://docs.aws.amazon.com/whitepapers/latest/data-classification/data-classification-overview.html; https://docs.aws.amazon.com/glue/latest/dg/security-lf-enable.html; https://docs.aws.amazon.com/lake-formation/latest/dg/tag-based-access-control.html] AWS Glue Data Catalog can support classification and metadata sharing, but consistent enforcement depends on coupling catalog resources to Lake Formation tags and permissions plus IAM rights, so the effective enforcement point sits in Lake Formation-governed execution rather than in the catalog entry itself.
  6. [medium] [inference; source: https://productresources.collibra.com/docs/collibra/latest/Content/AIGovernance/co_about-ai-governance.htm; https://productresources.collibra.com/docs/collibra/dqc/latest/Content/DataQuality/DQAdmin/co_sensitive-labels.htm; https://www.alation.com/blog/data-governance-for-ai-agents-what-you-need-to-know/] Collibra and Alation are best understood as governance-control-plane products for registry, workflow, classification, and lineage, not as independent runtime enforcement layers, because the reviewed materials emphasize documentation, lifecycle, labels, and compliance tracking more than direct prompt, retrieval, or connector blocking.
  7. [medium] [inference; source: https://gdpr-info.eu/art-5-gdpr/; https://handbook.apra.gov.au/node/115112; https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ai-agents/governance-security-across-organization; https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview] Personal, financial, and other regulated data should default to live entitlement checks, least-privilege connector access, DLP inspection before model input and outbound transmission, and tightly bounded retention, because privacy and prudential guidance treat unnecessary processing or disclosure of sensitive data as a control failure rather than as a mere governance exception.
  8. [medium] [inference; source: https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html; https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview; https://docs.aws.amazon.com/glue/latest/dg/security-lf-enable.html] Restricted and permission-variable data should avoid static copied indexes, exports, or cached memories unless entitlements are synchronized at query time or execution time, because prior repository research and current vendor documentation both show that copied permission models become fragile when access rights or sharing boundaries change.

Evidence Map

Claim Source Confidence Notes
[inference] Catalog metadata is not self-enforcing; runtime controls must consume it. https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview ; https://learn.microsoft.com/en-us/power-platform/admin/wp-data-loss-prevention ; https://docs.aws.amazon.com/glue/latest/dg/security-lf-enable.html high Cross-platform convergence on separate enforcement surfaces.
[fact] Microsoft Purview offers label persistence, supported AI-agent protection, and label-aware retrieval controls. https://learn.microsoft.com/en-us/purview/sensitivity-labels ; https://learn.microsoft.com/en-us/purview/ai-agents ; https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview high The reviewed Microsoft sources describe an end-to-end Microsoft-native metadata-to-control chain.
[fact] Power Platform DLP can block connectors and stop violating low-code assets at runtime. https://learn.microsoft.com/en-us/power-platform/admin/wp-data-loss-prevention medium Includes design-time and runtime effects plus propagation latency.
[inference] AI governance needs both catalog lineage and runtime trace lineage. https://learn.microsoft.com/en-us/purview/data-gov-classic-lineage ; https://docs.aws.amazon.com/datazone/latest/userguide/datazone-data-lineage.html ; https://mlflow.org/docs/latest/genai/concepts/trace/ high Catalog lineage and runtime traces cover different parts of the control path.
[fact] AWS enforcement depends on Glue metadata plus Lake Formation and IAM controls. https://docs.aws.amazon.com/whitepapers/latest/data-classification/data-classification-overview.html ; https://docs.aws.amazon.com/glue/latest/dg/security-lf-enable.html ; https://docs.aws.amazon.com/lake-formation/latest/dg/tag-based-access-control.html high Data catalog, policy tags, and execution permissions are separate but composable.
[inference] Collibra and Alation mainly provide governance-plane capabilities, not standalone runtime blocking. https://productresources.collibra.com/docs/collibra/latest/Content/AIGovernance/co_about-ai-governance.htm ; https://productresources.collibra.com/docs/collibra/dqc/latest/Content/DataQuality/DQAdmin/co_sensitive-labels.htm ; https://www.alation.com/blog/data-governance-for-ai-agents-what-you-need-to-know/ medium Collibra evidence is stronger than Alation because it comes from product documentation.
[inference] Sensitive and regulated data should use live checks, DLP, and bounded retention. https://gdpr-info.eu/art-5-gdpr/ ; https://handbook.apra.gov.au/node/115112 ; https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ai-agents/governance-security-across-organization ; https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview medium Derived by combining regulatory duties with documented technical control hooks.
[inference] Copied permission stores are fragile for restricted and frequently changing data. https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html ; https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview ; https://docs.aws.amazon.com/glue/latest/dg/security-lf-enable.html medium Prior repository research sharpens the current platform evidence.

Assumptions

  • [assumption; source: https://www.alation.com/blog/data-governance-for-ai-agents-what-you-need-to-know/] Assumption: Alation capability claims are treated as vendor-positioning evidence rather than as independently verified product mechanics. Justification: the official Alation source reviewed in this session was a vendor blog, not a product-reference page.
  • [assumption; source: https://learn.microsoft.com/en-us/purview/sensitivity-labels; https://docs.aws.amazon.com/lake-formation/latest/dg/tag-based-access-control.html] Assumption: The synthesized tier model below assumes enterprises map local labels or tags into a common operating pattern of public, internal, confidential, and restricted or regulated handling. Justification: the reviewed sources describe labels and tags but do not prescribe a universal four-tier taxonomy across vendors.

Analysis

[inference; source: https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview; https://learn.microsoft.com/en-us/power-platform/admin/wp-data-loss-prevention; https://docs.aws.amazon.com/glue/latest/dg/security-lf-enable.html] The evidence was weighted toward platform documentation that described where decisions are actually executed, because the research question is about enforcement rather than about catalog completeness or governance-process maturity. [inference; source: https://learn.microsoft.com/en-us/purview/sensitivity-labels; https://docs.aws.amazon.com/lake-formation/latest/dg/tag-based-access-control.html] Across vendors, the scalable pattern is attribute-linked authorization: a label or tag captures classification, and a runtime surface uses that attribute to decide whether a request, query, tool call, or connector action can proceed. [inference; source: https://learn.microsoft.com/en-us/purview/data-gov-classic-lineage; https://docs.aws.amazon.com/datazone/latest/userguide/datazone-data-lineage.html; https://mlflow.org/docs/latest/genai/concepts/trace/] Lineage had to be split into estate lineage and runtime lineage because governance teams need both provenance of source data and proof of what a specific AI or low-code execution actually touched. [inference; source: https://learn.microsoft.com/en-us/purview/sensitivity-labels; https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ai-agents/governance-security-across-organization; https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview; https://docs.aws.amazon.com/lake-formation/latest/dg/tag-based-access-control.html] A practical tier model is: public data can use ordinary authorization and standard logging; internal data adds approved-connector and ownership controls; confidential data adds label-aware retrieval, runtime traceability, and restricted outbound connectors; restricted or regulated data adds live entitlement checks, pre-input and pre-output DLP inspection, and a default ban on static copied stores unless explicitly approved. [inference; source: https://gdpr-info.eu/art-5-gdpr/; https://handbook.apra.gov.au/node/115112; https://davidamitchell.github.io/Research/research/2026-04-26-permission-safe-rag-enterprise-information-architecture.html] The practical trade-off is between the implementation convenience of copied stores and the control fidelity of live checks, with higher-sensitivity and more permission-volatile data pushing strongly toward live checks or label-aware retrieval over static copies.

Risks, Gaps, and Uncertainties

  • [fact; source: https://www.alation.com/blog/data-governance-for-ai-agents-what-you-need-to-know/] The Alation evidence base in this item is thinner than the Microsoft, AWS, and Collibra evidence base because it relied on official vendor blog material rather than product-reference documentation.
  • [fact; source: https://handbook.apra.gov.au/node/115112] The seeded APRA PDF URL was dead during this session, although the official APRA Handbook page exposed the necessary guidance content.
  • [fact; source: https://www.nist.gov/privacy-framework] The National Institute of Standards and Technology (NIST) Privacy Framework page establishes the framework's purpose and voluntary status, but this item did not rely on detailed subcategory mapping from the framework core because the fetched Portable Document Format (PDF) content was not cleanly machine-readable in this environment.
  • [inference; source: https://learn.microsoft.com/en-us/purview/ai-agents; https://learn.microsoft.com/en-us/purview/developer/secure-ai-with-purview] Some Microsoft Purview AI pages are partially authorization-gated in rendered form, so this item limits itself to claims that were visible in the accessible page content.

Open Questions

  • [inference; source: https://productresources.collibra.com/docs/collibra/latest/Content/AIGovernance/co_about-ai-governance.htm; https://www.alation.com/blog/data-governance-for-ai-agents-what-you-need-to-know/] Which runtime integrations do Collibra and Alation customers actually deploy most often to convert catalog policy into AI prompt-time or low-code execution-time controls?
  • [inference; source: https://learn.microsoft.com/en-us/power-platform/admin/wp-data-loss-prevention] How should enterprises design compensating controls for the documented Power Platform policy-propagation window when emergency connector blocking is required faster than the normal propagation cycle?
  • [inference; source: https://mlflow.org/docs/latest/genai/concepts/trace/; https://learn.microsoft.com/en-us/purview/data-gov-classic-lineage] What is the cleanest enterprise pattern for joining catalog lineage graphs with AI runtime traces so that a single investigation can traverse from source record to generated output without manual correlation?

Output

Navigation

Home

By Tag

bureaucracy

change-management

coase

constraint-analysis

control-model

decision-rights

delegation

delivery-risk

demand-segmentation

enterprise

exception-handling

execution

flow

flow-design

flow-metrics

governance

governance-patterns

incentives

instability

institutional-economics

leading-indicators

operating-model

organisation

organisational-design

queue-design

queueing

regulated-enterprise

routing

throughput

throughput-risk

transaction-costs

triage

williamson

Clone this wiki locally