Data governance & guardrails

Knowing what data you hold, who can reach it, and what the AI systems are allowed to do with it.

Discuss your project Learn this field

What is it?

Governance earns its keep when it is enforced by the platform rather than written in a policy nobody reads. We implement classification, access control, retention and audit as working controls, including the specific questions AI raises about what may be sent to a model and what must be logged.

For a technical reader

Governance that lives in a policy document does not survive contact with a query engine. Enforcement belongs in the data layer: row-level security predicates, column masking policies and tag-based access rules applied at the warehouse, so any tool connecting through it inherits the controls. For AI specifically, the new questions are which classifications may be included in a prompt, what is redacted before egress, and whether prompts and responses are retained — all of which need to be answerable as configuration, not convention.

Our services

Data discovery and classificationFinding what personal, financial and confidential data exists across the estate, and tagging it.
Access control implementationRole-based access, row-level security and column masking enforced in the platform.
Retention and deletionImplemented schedules, including the deletion requests you are legally obliged to honour.
AI data boundary designExplicit, enforced rules on what may reach a model, what is redacted, and what is logged.

What’s covered

Catalogue and classification
Discovery of what data exists and tagging of what is sensitive
Row and column security
Masking and filtering enforced in the data layer, applying to every tool that queries it
Retention and deletion
Implemented schedules, including the deletion requests you are obliged to honour
AI data boundaries
Explicit rules on what may be sent to a model, what is redacted and what is logged
Access audit
Who read what and when, answerable as a query

Business problems we solve

We do not know where personal data isDiscovery and classification before policy. You cannot govern an unknown estate.
Everyone has access to everythingBroad access is usually historic convenience. Role-based access with masking narrows it without blocking legitimate work.
We cannot answer an audit question quicklyAccess logging that can be queried turns a reconstruction exercise into a report.
Nobody will sign off the AI projectBecause the data boundary is undefined. Making it explicit and enforced is what unblocks approval.

Our delivery approach

  1. 01
    Inventory and classifyYou cannot protect what you have not found. Discovery comes before policy.
  2. 02
    Enforce in the platformAccess and masking rules live in the data layer, so they apply regardless of which tool is querying.
  3. 03
    Set AI boundaries explicitlyWhich data may reach a model, which must be redacted, what gets logged. Written down and enforced, not assumed.
  4. 04
    Make audit a queryWho accessed what, when, answerable on demand rather than reconstructed under pressure.

Solutions & project types

Examples of the work we take on in this area. These describe project shapes, not named client engagements.

Data catalogue rolloutA searchable inventory with ownership, classification and lineage.
Access remediationReducing over-broad warehouse access to role-appropriate views with masking.
Subject access and deletionAutomating the lookup and deletion workflow across systems.
AI usage policy enforcementTechnical controls backing the written policy on what may be sent to a model.

Technologies & platforms

Catalogue

  • Collibra
  • Alation
  • DataHub
  • OpenMetadata
  • Microsoft Purview

Enforcement

  • Snowflake masking policies
  • BigQuery column-level security
  • Immuta
  • Apache Ranger

Discovery

  • Automated PII scanning
  • Classification tagging
  • Lineage capture

AI controls

  • Prompt and response logging
  • PII redaction pipelines
  • Model allow-lists

Frameworks

  • GDPR
  • CCPA
  • SOC 2
  • NIST AI Risk Management Framework
Learn this field

Where to start with data governance & guardrails.

Secondary to the work itself, but genuinely useful if you are building the skill. Every link goes to official documentation or an official channel.

Beginner

  • What counts as personal data under GDPR and CCPA
  • Classification levels and why they exist
  • Role-based access control basics
  • Reading a data flow diagram

Intermediate

  • Row-level security and dynamic masking in a warehouse
  • Data lineage capture and why it matters for audit
  • Retention schedules and lawful deletion
  • Building a catalogue people actually use

Advanced

  • Policy as code and automated enforcement
  • Privacy-enhancing techniques: pseudonymisation, differential privacy
  • AI governance: model inventory, evaluation records, incident process
  • Cross-border transfer and data residency design

Certifications

  • IAPP Certified Information Privacy Professional (CIPP)
  • IAPP Certified Information Privacy Technologist (CIPT)
  • Microsoft Certified: Information Protection and Compliance Administrator Associate
  • SnowPro Advanced: Administrator

Practice projects

  • Scan a sample database and classify every column
  • Implement column masking so analysts see tokenised values
  • Add row-level security by region and test it from two accounts
  • Write a deletion job that proves the record is gone everywhere
  • Build a redaction step before any text is sent to a model
FAQs

Questions we get asked.

Will governance slow our analysts down?

Badly implemented, yes. Done in the data layer with sensible default roles, most analysts see no change — they keep querying, and the controls apply underneath.

Do we need a catalogue tool?

Not immediately. Below a certain estate size a maintained inventory is enough. Tools help when nobody can hold the map in their head, and they still need an owner.

How does this apply to AI?

Directly. The questions AI raises — what data may be in a prompt, what leaves the boundary, what is retained — are governance questions. We implement them as enforced controls rather than guidance.

Is this a compliance project?

Compliance is an outcome, not the purpose. The practical benefit is that people can find data they are allowed to use, and cannot reach data they are not.

AI & Data

Related services.

GenAI assistants & copilotsAssistants grounded in your own content, with the evaluation to show whether they are actually right.Forecasting & machine learningModels that stay in production and keep being retrained, not a notebook that was accurate once.Data platform & warehousingOne place where the numbers agree, with lineage back to the source.Document & contract intelligenceExtracting structured, checkable data from contracts, invoices and forms at volume.
Start the conversation

Talk to our experts about data governance & guardrails.

Tell us where you are. A specialist will read it and reply within one business day.

Discuss your project