Data Leakage Prevention — Patterns

Carry the label through every derivation

Problem. A pipeline transforms text continuously: it extracts, chunks, summarises, translates, embeds, and caches. Each stage produces a new artifact, and by default that artifact is born unclassified. The summary of a restricted document is a perfectly ordinary paragraph as far as every downstream component is concerned.

Approach. Make the classification a required field on every unit of text, and make every transformation stage take the most restrictive label of its inputs and write it onto its outputs. Where a stage mixes sources, the output carries the union of their constraints. Nothing may be written without a label, which means a stage that does not know how to propagate fails loudly rather than quietly emitting unlabelled text.

Trade-off. Labels only ever escalate under this rule, so a corpus drifts towards maximal restriction over time and eventually stops being useful, which creates pressure for manual declassification that is itself a disclosure decision with no obvious owner. Enforcing the rule also touches every component in the pipeline, including the ones written before anyone thought about classification.

Decide against the recipient, at the moment of emission

Problem. Entitlement is checked when a document is fetched, which is correct and insufficient. The answer is produced later, possibly for a different participant in a shared session, possibly for a channel with its own audience, and the entitlement that justified the retrieval does not describe the person who will read it.

Approach. Attach the recipient's effective entitlement to the emission itself, not to the request that started the run, and evaluate the outbound content against it at the point it leaves. For a multi-participant surface, that means resolving the audience of the specific destination — the channel members, the mailing list, the external address — rather than the identity of whoever typed. An emission whose audience cannot be resolved is treated as an external one.

Trade-off. Resolving an audience is a lookup against systems that are often slow, eventually consistent, or outside your control, placed on the latency path of every response. The strict default also makes a system unhelpful on exactly the collaborative surfaces where people most want it, and the pressure to relax it arrives within a week of launch.

One egress inventory, enumerated and tested

Problem. Teams protect the path they picture. The paths they do not picture — a notification service, a nightly export, a support tool that replays conversations, a crash reporter that attaches the prompt — reach outside the boundary with the same content and none of the checks.

Approach. Enumerate every way bytes leave the system, including the ones operated by other teams, and treat the list as an artifact that is reviewed and tested rather than documented once. For each path, record what check it carries and who owns it. Test by seeding marked content and confirming it is stopped on every listed path, and treat an unlisted path discovered later as an incident rather than as a gap.

Trade-off. The inventory ages the moment it is written, and keeping it current is unglamorous work that competes with features. Testing each path with marked content also means deliberately pushing sensitive-looking material through production systems, which needs its own approval and occasionally alarms the people monitoring them.

Seed canaries and watch for them everywhere

Problem. Absence of detected leaks is not evidence of absence. Every control described here can be correctly implemented and still miss the disclosure that happens through a path nobody modelled, and nothing in the system will ever raise a signal about it.

Approach. Plant uniquely identifiable synthetic records through the corpora, the memory stores, and the tenants — documents that look real, belong to nobody, and contain a string that occurs nowhere else. Monitor for those strings in outputs, logs, exports, external search, and anywhere else you can reach. An appearance is unambiguous proof of a specific path, which is the one thing this capability otherwise cannot obtain.

Trade-off. Canaries measure only the paths they happen to be exposed to, and a disciplined attacker who notices the pattern will avoid them. They also pollute the corpus with fabricated records that will eventually be retrieved and quoted to a real user, so each one needs to be plausible enough to travel and harmless enough to be read aloud.