Compliance-in-Motion — Enforcing Consent, PII, and Do-Not-Train in the Pipeline

Quarterly audits cannot govern agentic systems. By the time a control review finds a problem, an AI agent has already answered thousands of queries against the data in question. Compliance for AI has to move at the speed of the pipeline — enforced at the point of access, not reconstructed after the fact. We call this compliance-in-motion.

The regulatory substrate

AI-ready banking data sits on top of a stack of regulatory anchors. Each maps to a concrete control the platform must enforce:

Regulation	What it requires	Control in the pipeline
GDPR	Data minimisation, accuracy, privacy by design	Purpose tags, masking, retention at query time
GLBA Safeguards Rule	Written info-security program	Encryption, MFA, provider oversight
NY DFS	Explicit data inventories	Governance procedures + AI-system inventories
OCC Model Risk	Governance + validation	Monitoring for material banking models
BCBS 239	Principles-based risk-data aggregation	End-to-end lineage + deterministic explainability
NIST AI RMF	Govern · Map · Measure · Manage	The AI-risk operating structure

Cumulative GDPR fines alone exceed €6.7 billion — the cost of governing after the fact is not hypothetical.

Three enforcement points

Compliance-in-motion means three things enforced inline, in every pipeline hop:

1. Consent signal propagation

Consent events (from a broker like OneTrust) stream into a low-latency policy decision point that feeds every federated query engine. A withdrawn consent propagates to agents in under 100 ms — not on the next nightly batch.

# consent event → policy decision point → all federated engines
for evt in stream.read("onetrust.consent"):
    purview.set_policy(evt.asset, {
        "doNotTrain": evt.purpose == "DoNotTrain",
        "consentSource": evt.source,
        "maskingRule": derive_mask(evt.classification),
    })
    uc.apply_row_filter(evt.asset, evt.region_rule)
    mcp.policy.push(evt.asset)   # < 100 ms to agents

2. "Do-Not-Train" isolation

Records tagged Do-Not-Train are auto-excluded from RAG indexes and fine-tuning datasets via Unity Catalog tag filters. Isolation happens at index-build time, so a Do-Not-Train record can never leak into a model's training set or a retrieval context.

3. PII leakage detection

Attribute-based access control (Immuta / Privacera) evaluates consent and purpose tags inline with Unity Catalog row/column policies. On top of that, PII guardrails (Presidio + LLM guardrails) scan agent prompts and outputs — violations block delivery and alert risk. Permission checks run in under 10 ms so enforcement does not cost latency.

Governed at every hop

The principle is that no stage is un-governed. In the unstructured and real-time pipelines alike, consent and Do-Not-Train signals travel with the data, and steward review gates persistence and indexing:

Ingest → OCR/NLP enrich → vector embeddings → steward review → RAG grounding
                                              (Databricks Apps gate)
   consent + Do-Not-Train propagate at the point of access — every hop governed

A record that arrives with a Do-Not-Train tag is never embedded, never indexed, never retrievable. Governance is a property of the pipeline, not a downstream audit.

Why this beats phase-two governance

When governance is a "we'll add it later" workstream, it never fully arrives — and every model trained in the interim is a liability. Building controls into the substrate means AML, KYC, and OCC patterns ship with the data products, and the estate is audit-ready by construction. This also lowers compliance cost materially — typically 30–50% versus bolt-on controls — because the evidence trail is generated automatically.

The path to implement

1. Wire a policy decision point fed by your consent broker; push decisions to every query engine.
2. Enforce row/column policies and PII masking at the query engine (Unity Catalog + Immuta/Privacera), not in application code.
3. Apply Do-Not-Train tag filters at RAG index-build and fine-tuning dataset assembly.
4. Add prompt/output guardrails (Presidio + LLM) that block violations and alert risk.
5. Log every override to the catalog with reviewer, timestamp, and rationale for an audit-ready trail.

GovPilot enforces access, PII handling, and model oversight as continuous agents — OCC, AML, and KYC patterns ready from day one. The human-in-the-loop spine is what keeps every override defensible.

Talk to us about governed AI →