AID-H-029: AI Data-Use Authorization & Lifecycle-Stage Boundary Enforcement
Operationalization: The technique operationalizes consent scope, contractual purpose limitations, jurisdictional restrictions, and internal data classification policies into machine-enforceable gates at each lifecycle-stage boundary.
Examples:
- Customer service transcripts authorized for real-time support but prohibited from fine-tuning.
- Legal documents authorized for RAG retrieval but prohibited from long-term memory.
- HR data authorized for summarization but prohibited from shared indexes or retraining corpora.
Scope boundary
Owns machine-enforced decisions about whether a data asset may be used for a declared AI purpose and lifecycle stage, including training, evaluation, indexing, inference, logging, memory, and retraining. It does not establish provenance, authorize runtime sinks, or enforce retention duration.
AID-M-002: AID-H-029 enforces permitted purpose and lifecycle-stage use; AID-M-002 records provenance, lineage, integrity, and risk evidence about the asset. Knowing where data came from does not decide whether it may be used for a particular purpose.
AID-H-018.005: AID-H-029 decides whether data may participate in a lifecycle stage or purpose; AID-H-018.005 constrains where specific values may flow at runtime and which sinks may receive them. Authorized use does not authorize every destination, and an allowed sink does not authorize an otherwise prohibited purpose.
AID-I-004.005: AID-H-029 controls whether data may enter or remain authorized for a stage; AID-I-004.005 enforces how long retained memory may persist and proves forgetting. Use authorization and retention duration are independent policy dimensions.
Warning
Regulatory Compliance Critical
Consent and authorization state can change after ingestion.
- Consent scope changes over time: Data that is allowed for real-time interaction may be prohibited for training, long-term memory, or future retraining. Authorization must be checked at each stage transition, not only at ingestion.
- Indirect stage transitions matter: Data can cross boundaries through paths such as inference logs into retraining corpora or RAG context into agent memory. Enforcement must cover both direct and indirect lifecycle transitions.
Sub-techniques
Threat mappings
MITRE ATLAS
- AML.T0057 LLM Data Leakage
- AML.T0080 AI Agent Context Poisoning
- AML.T0080.000 AI Agent Context Poisoning: Memory
- AML.T0130 AI Agent Response Biasing
- AML.T0131 Crafted AI Assistant Links
MAESTRO
- Regulatory Non-Compliance by AI Security Agents (L6)
- Data Leakage (Cross-Layer)
OWASP LLM Top 10 2026
- LLM02:2026 Sensitive Information Disclosure
- LLM05:2026 Data and Model Poisoning
OWASP ML Top 10 2023
- N/A
OWASP Top 10 for Agentic Applications 2026
- ASI06:2026 Memory & Context Poisoning
NIST Adversarial Machine Learning 2025
- NISTAML.036 Leaking information from user interactions
Cisco Integrated AI Security and Safety Framework
- AITech-8.2 Data Exfiltration / Exposure
- AITech-8.3 Information Disclosure
- AITech-16.1 Eavesdropping
- AISubtech-6.1.1 Knowledge Base Poisoning
- AISubtech-8.3.3 Personally Identifiable Information Exposure
- AISubtech-14.1.2 Insufficient Access Controls
- AISubtech-16.1.1 Logging Sensitive Conversations
Google Secure AI Framework 2.0 - Risks
- UTD: Unauthorized Training Data
- EDH: Excessive Data Handling
- SDD: Sensitive Data Disclosure
Databricks AI Security Framework 3.0
- Raw Data 1.2: Missing data classification
- Raw Data 1.6: Insufficient data lineage
- Raw Data 1.8: Legality of data
- Governance 4.1: Lack of traceability and transparency of model assets
- Model Serving - Inference requests 9.10: Accidental exposure of unauthorized data to models
- Platform 12.6: Lack of compliance
- Agents - Core 13.1: Memory Poisoning