The copies you are not counting
Ask a security team where the sensitive data is and they will point at production: the core banking system, the customer master, the warehouse. Those systems have the controls, the monitoring and the budget. Then ask where copies of that data are, and the answer gets vague. Development environments. Test environments refreshed from production last quarter. An analytics sandbox. A data science notebook. A vendor’s UAT instance. A CSV somebody exported to build a demo.
Every one of those copies carries the same customer records, the same account numbers, the same personal data as production, with a fraction of the protection. Breaches in non-production environments are not exotic; they are routinely the path of least resistance. And the organisation usually cannot say how many copies exist, because nobody is responsible for counting them.
AI operates at machine speed
That was the situation before AI. Now add models that need data to train on, retrieval systems that need documents and records to ground their answers, agents that need access to systems of record to do their work, and developer tools that read and write the codebase — and the artefacts around it — continuously.
Software delivery data is a good illustration of the scale. The lifecycle around a modern application generates far more than source code: configuration, test data, build artefacts, logs, secrets, tickets, telemetry. A large organisation already runs tens of thousands of automated jobs against that data every day. Wire AI into the pipeline and the volume of access rises by an order of magnitude, most of it initiated by machines rather than people, most of it never seen by a human reviewer.
The controls that worked when a developer occasionally pulled a copy of a table do not work when a retrieval pipeline reads the entire document store on a schedule. Something has to change in the model, not just the monitoring.
Governance has to travel with the data
The principle is simple to state: classification, masking and access policy must be applied at the point the data is copied or accessed, automatically, rather than depending on whoever made the copy remembering the rules.
In practice that means three things.
- Classify once, at the source. The warehouse or catalog knows which columns are personal data, which are financial, which are restricted. That classification should follow the data into every downstream environment, not be re-guessed by each team.
- Mask or synthesise by default outside production. Development, test and AI training sets should be built from de-identified or synthetic data that keeps the statistical shape of production without the identities. The exceptions where real data is genuinely needed should be explicit, approved and logged — not the norm.
- Give AI one governed access path. Rather than extracts, models and agents should reach data through a connector that enforces the same row-level permissions, classification and audit as a human query would. Emerging standards for tool and data access make this practical; the point is that the model inherits the governance of the system it reads, instead of bypassing it with a copy.
The warehouse as the source of truth for AI
There is an opportunity hiding inside this problem. Organisations that have invested in a governed data platform — a warehouse or lakehouse with lineage, a catalog with classification, access controls that security has actually reviewed — already own the hardest part of AI data governance. The platform is the one place where the data is known, classified and controlled.
The mistake is to treat AI as a reason to make new copies of it. The better pattern is to make the governed platform the place AI reads from: retrieval over catalogued documents, agents querying through the warehouse’s own permissions, training sets generated from masked views rather than raw exports. Every copy avoided is a breach path closed and an audit question answered in advance.
Where to start
- Inventory the copies. Most organisations are surprised by the number, and the inventory alone changes behaviour.
- Decide the default: masked or synthetic outside production, with real data as a logged exception.
- Route AI access through the governed platform, and log what models and agents read, the way you log what people read.
- Assign ownership. Someone must be accountable for non-production data the way someone is for production.
None of this slows AI adoption. It is what makes AI adoption survivable when the first serious question about where the training data came from arrives — from an auditor, a regulator or a customer.
