CABIER Global Assurance · Reference architecture

    AI Data & IP Assurance

    The question institutions are now asked, and frequently cannot answer, is short: where did the data go? Which model touched it, which agent reached it, under whose authority, in which jurisdiction, and was training use permitted.

    This is expressed through the evidence vault, the relationship graph and the assurance record already in use. It is not a second data lineage platform.

    Reference architecture. Records flows the institution has granted visibility over. It does not claim to observe provider-internal processing that has not been evidenced.

    The questions it has to answer

    • Where did the data go?
    • Which model touched it?
    • Which agent accessed it?
    • Under what authority?
    • Was training use permitted?
    • Which provider processed it?
    • Where was it processed?
    • What contractual restrictions applied?
    • What evidence exists?
    • Who owns the consequence?

    The chain

    Traversable in the relationship graph, in both directions.

    DataModelAgentPermissionPurposeProviderProcessing locationTraining useThird partyContractual restrictionRegulatory obligationEvidenceOwner

    What the record holds

    This extends the existing evidence vault and relationship graph. It records flows the institution has granted visibility over. It does not claim to observe a provider's internal processing that the provider has not evidenced.

    Data class and owner

    Classification and a named owner, because consent and restriction attach to a class.

    Permitted purpose

    The purpose it was collected for, which constrains every later use.

    Model and agent access

    Which model and which agent reached it, at which version, on what date.

    Provider and processing location

    Who processed it and in which jurisdiction, including inference and caching.

    Training use position

    Whether the data may contribute to training, stated rather than assumed either way.

    Third-party onward flow

    Sub-processors and tool servers that received it as a consequence of an action.

    Contractual restriction

    The clause that limits use, held next to the evidence that it was honoured.

    Regulatory obligation

    The residency, privacy, secrecy or sector duty engaged by that flow.

    Evidence and expiry

    The dated proof, and the point at which it stops describing the present.

    A flow that crosses a boundary

    Deterministic and synthetic. No customer data is used.

    Synthetic demonstrator · illustrative

    AI data and IP assurance

    Client material reaching a model through an agent and a tool server

    Consequence class: Regulated
    1. 1. Data
    2. 2. Reach
    3. 3. Onward flow
    4. Assurance state

    Data and intellectual property position belongs on the assurance record itself, with an owner and an expiry.

    See where the record lives