Executive briefThe assistant answered correctly and still caused a breach

An employee asked an assistant for a concise account review before a customer call. The assistant retrieved records the employee could lawfully inspect, noticed a useful pattern across two linked accounts and emailed a polished summary. Every sentence was factually supported. The email went to a familiar corporate domain. The recipient, however, worked for a different client team, the linked account belonged to another tenant and the summary exposed a sensitive inference that no single source field contained.

No attacker had copied a database. No secret string appeared. The model behaved helpfully, the email tool worked as designed and conventional source access checks all returned allow. The failure occurred at release. The system confused permission to consult information with permission to disclose a transformed object to a particular recipient for a particular purpose. That confusion is especially hazardous in generative systems because the released object can combine, compress, infer, translate or reconstruct meaning.

Exfiltration therefore includes more than verbatim leakage. A model can place context in a URL query, a tool parameter, generated code, an image caption, a filename, an error message, a log or an external message. It can reveal membership in a small group through repeated aggregates. It can infer a protected attribute from ordinary facts. It can answer from the wrong tenant after a retrieval boundary failed. It can convert confidential prose into an embedding whose downstream use preserves information even when visible fields were redacted.

The decisive control point is the information release. Before data crosses a boundary, the system resolves who requested the release, whose mandate is being exercised, why the task exists, which sources contributed, whether each read was current, what direct and derived sensitivity remains, the exact release object, the recipient and downstream purpose, the channel and destination, prior disclosures, permitted transformations and the response owner. The model can propose an answer. It cannot authorise the answer it composed.

This paper introduces a thirteen-field Information Release Record, an eight-stage Information Release Gateway and a cumulative Semantic Egress Budget. Together they govern the path from entitled source to independently observed destination. They apply whether the trigger is ordinary error, insider curiosity, prompt injection, compromised workflow or sincere automation. Prompt injection remains an important cause, but the release boundary must hold even when no hostile instruction exists.

The strongest rival: conventional controls prevent many leaks

Access control, data loss prevention, secret scanning, network egress filtering, approved domains and narrow tools remain essential. Deterministic rules can block known secrets, prohibited fields, unsupported protocols and obvious cross-tenant identifiers with speed and explainability. A secure email gateway can verify recipient policy more reliably than a language model. A tool contract can remove arbitrary URLs and messaging altogether.

A semantic gateway adds cost and uncertainty. Classifiers can miss indirect meaning, overreact to harmless text or impose latency on legitimate work. Derived-sensitivity judgements may require privacy, legal or domain expertise. The answer is not a promise of perfect semantic inspection. It is a layered architecture: deterministic restrictions first, narrowly typed proposals, provenance and budget state, semantic signals, minimising transformations, accountable approval for consequential uncertainty and denial where the channel cannot enforce the decision.

Information Release RecordThirteen fields turn an answer into a governed release

The record is assembled from authoritative systems rather than trusted because it appears in one catalogue. Identity provides the principal. Source systems provide entitlements and effective time. Provenance services identify inputs and transformations. Policy supplies purpose and destination rules. The channel reports the actual recipient and effect. The budget service retains cumulative state. These records can be joined by a release identifier while protected content remains compartmented.

Proposed content and released content are different states. A model may propose a full personnel record; the gateway may reduce it to a single permitted field. The receipt describes the class and transformation of what actually left, not the confidential draft. This distinction lets security teams preserve evidence without widening exposure through alerts, dashboards or tickets.

Information Release GatewayInterpose an independent decision before any content-bearing effect

1. Typed proposal. The model or workflow submits a structured object that identifies intended content class, recipient, destination, channel and requested transformation. It has no external email, browser or service credential. Free-form narrative can accompany the proposal, but it cannot alter the schema, policy or recipient identity.

2. Provenance, entitlement and purpose resolution. The gateway obtains source identifiers and transformations from the retrieval and workflow trace, resolves current source permissions, and checks the active business mandate. It does not trust model assertions that the data were public, that the user already knew them or that disclosure is necessary.

3. Direct and derived sensitivity detection. Deterministic classifiers identify credentials, identifiers, regulated fields and known confidential objects. Semantic methods examine inference, linkage, small-group disclosure, reconstruction and contextual sensitivity. Uncertainty is carried into the decision rather than converted into an invented fact.

4. Policy and budget evaluation. Policy joins requester, principal, tenant, affected subject, destination, recipient, jurisdiction, downstream purpose, channel and cumulative release state. A technically authenticated destination can still be denied. A permissible first answer can make a later answer impermissible when their combined meaning exceeds the budget.

5. Transformation or approval. The gateway can remove fields, replace identifiers with scoped tokens, generalise dates, aggregate only above a justified group threshold, suppress a sensitive inference, choose an internal view or request accountable approval. Approval sees the decision-relevant content and uncertainty through a protected interface, not a broad logging system.

6. Narrow channel execution. Only after allow does the gateway issue a transaction-specific credential to a channel constrained to the selected recipient, object and action. The model never receives a general mailbox token or arbitrary browser route. Redirects, attachments, metadata and error paths remain inside the same enforcement boundary.

7. Destination and effect receipt. The receiving system reports the actual person, domain, tenant, jurisdiction, object class, accepted or rejected state and side effect. A successful API call is not enough if the resource applied a redirect, expanded a group or wrote into a different tenant. Failures and partial effects receive receipts too.

8. Budget and anomaly update. The gateway reserves budget before execution and commits actual consumption after the effect receipt. Failed or uncertain delivery does not automatically restore capacity because a recipient may still have seen data. Anomaly signals can pause the session, revoke channel credentials and open investigation before another release.

Complete mediation matters. If a model can bypass the gateway through a general shell, browser, clipboard, image fetch, log statement or support connector, the architecture has only a preferred route, not a release control. Where a tool cannot enforce object, destination and recipient constraints, replace it with a bounded service or keep the workflow human-operated.

Source entitlement versus destination authorisationEvery read may be allowed while the combined release is forbidden

Source controls answer a necessary but incomplete question. An analyst may inspect individual incident records to investigate a named case, yet lack permission to publish a regional pattern. A service agent may view two customer records during separate authorised calls, yet must not join them into a single response. A manager may read personnel data for supervision, yet may not email inferred health or union information to a project group. The release object creates a new policy event.

Destination authorisation is more specific than domain allow-listing. The gateway resolves the actual person or service account, tenant, group expansion, jurisdiction, downstream purpose and retention. A partner's corporate domain may host many teams. A shared channel may include guests. An internal analytics service may be permitted to receive tokenised data but not raw identifiers. Recipient membership and purpose are checked at the moment of release, not inferred from a familiar address.

Purpose must survive transformation. A source read authorised to answer a customer's question does not support model training, product analytics or a marketing list. Terms of use and employee policy do not compensate for a tool that can technically send broader content. Enforcement turns purpose into destination, object, channel, time and budget constraints, with a named owner for cases that need interpretation.

Time also splits the decisions. A source entitlement can expire while an answer remains in draft. A recipient can change role. A legal hold can alter permitted handling. A cross-border route can change after a provider failover. The gateway resolves effective state again immediately before the effect and records the versions used. Long generation time is not a reason to reuse stale authorisation.

Semantic Egress BudgetCount reconstructable meaning, not only bytes

A release budget is a policy state, not a token counter. It records affected subjects, fields, categories, inference classes, files, destinations, time windows and linkability. The unit may be a protected fact, a small-group slice, a row-equivalent, a subject-level profile or a reconstruction contribution. Different units remain visible because adding them into one score would hide which boundary is being consumed.

Repeated aggregate queries illustrate the need. A team may be permitted to see incident rates for sufficiently large groups. Queries that successively filter by location, age band, team and rare event can isolate one person. Each answer appears aggregate and each contains few numbers. Together they reveal a confidential fact. The gateway compares the proposed query with previous releases to the same principal, purpose and related recipients, applies minimum-group and repeated-query rules, and refuses or generalises the answer before reconstruction becomes practical.

Budgets survive a new chat, device or agent handoff. Starting another conversation cannot restore disclosure capacity. State is keyed to the business principal, mandate, purpose, subject population and destination relationship, with policy-defined time. Colluding recipients and delegated agents require joined analysis where the organisation has evidence of a shared purpose or channel. Perfect detection of collusion is unrealistic, so high-consequence datasets also use narrow query interfaces and output forms.

Budget reservation precedes external execution. If an email call times out after acceptance, the system treats delivery as uncertain and does not immediately replenish capacity. The destination receipt later commits or releases the reservation. Compensation, deletion requests and revocation can reduce ongoing exposure but do not erase that information may have been seen or copied. Recovery state is recorded separately from future release authority.

Replenishment requires policy, elapsed time and accountable purpose. Some public facts consume no protected budget. A field-minimised answer may consume a specific subject-field unit. A justified recurring report may receive a scheduled allowance. An exception has a recipient, object, expiry and owner. The organisation does not set a universal safe number of tokens or rows; it defines boundaries tied to sensitivity, consequence, population and reconstructability.

Layered controls and honest limitsUse semantic classification as evidence, not as an oracle

Deterministic controls should remove avoidable ambiguity. Source systems enforce row and field entitlements. Typed tools exclude arbitrary endpoints and free-form headers. Secret scanners recognise governed credentials and canary values. Schemas reject unexpected metadata. Network policy blocks unapproved protocols and destinations. Recipient directories resolve group membership. These controls are fast, testable and suited to facts that do not require model judgement.

Semantic methods then address meaning that does not share a stable string. They can flag a probable medical inference, recognise a customer detail in generated code, compare an answer with source sensitivity, identify a small group or detect a request to embed context in a URL. Their result carries model, version, evidence, uncertainty and failure modes. A low classifier probability cannot grant a release that deterministic policy forbids, and a high probability need not cause broad incident copying.

Transformation is tested against the actual downstream object. Removing names may leave a unique combination of role, date and location. Aggregation requires a defensible group rule, linkage analysis and repeated-query control. Generalisation can alter dates or categories while preserving the task. Tokenisation can support joining without revealing an identifier, but the token service and mapping remain sensitive. Embeddings and image metadata are assessed as release objects rather than assumed anonymous.

Accountable approval is for uncertainty and consequence, not for routine rubber-stamping. The reviewer sees the principal, purpose, sources, proposed and minimised forms, derived-sensitivity explanation, recipient, channel, prior budget consumption and alternatives. They can approve a bounded object, require another transformation, change the channel, deny or return the case to the policy owner. Their decision is signed, expires and does not silently expand later releases.

Testing combines ordinary work and adversarial paths. Cases vary prompt source, tenant, recipient, redirect, file type, metadata, encoded values, logs, partial failure, group size, repeated queries, model version and human approval. Carlini and colleagues demonstrated that language models can expose memorised training examples under extraction attacks; Greshake and colleagues showed indirect prompt injection can drive data theft through integrated applications; AgentDojo supplies dynamic tool-agent test patterns. These studies motivate threat cases, not universal leakage rates or proof that one detector is complete.

Quarantine, evidence and redressContain the path without creating a second disclosure

When a proposal contains a production credential, cross-tenant object or suspicious URL payload, the gateway stops new releases, revokes the transaction credential and quarantines the workflow state. It preserves source identifiers, hashes, policy versions, recipient decision, channel events and effect receipts. The protected evidence store retains content only where investigation or legal duties require it. General alerts carry a release identifier and sensitivity class, not the proposed secret or personal record.

The response team determines what actually left. It distinguishes blocked proposals, accepted transmissions, redirected effects, partial attachments, cached previews and uncertain timeouts. Destination receipts, channel telemetry and resource logs support the review. Absence of an observed delivery is not proof of containment when coverage is incomplete. The possible exposure window runs from the first risky proposal through effective revocation and repaired enforcement.

Credential exposure invokes the lifecycle from Paper 114, but credential rotation is only one strand. Teams also invalidate links, retract files where possible, correct cross-tenant records, notify accountable privacy and security roles, identify affected people or counterparties, preserve rights and provide redress where required. The recovery owner must reconcile business effects before the incident closes.

Reauthorisation follows repair. The failed channel or classifier is tested against the general mechanism, not only the exact incident string. Budget state is reconciled. Compromised sessions and delegated identities receive fresh mandate decisions. If a general browser, shell or messaging tool cannot enforce destinations and semantic limits, it remains revoked and the workflow moves to a bounded service or human path.

Ten worked casesTrace source, meaning, destination, budget and effect

1. Public-information assistant

The requester is anonymous but the task is limited to a verified public corpus. Provenance shows no private memory or prior output. Sensitivity and derived-meaning checks find only already published facts. The UI is the destination, the public budget class is non-consuming and the receipt records the cited sources and visible answer. Outcome: release the bounded public or entitled answer.

2. Employee personnel question

An authenticated manager asks for one employee's current leave balance for a documented planning purpose. The source read is authorised, but the retrieved record contains address, medical notes and payroll fields. The proposed object is reduced to the balance and effective date, shown through the protected employee interface, and one subject-field unit is committed to the budget. Outcome: minimise, redact or aggregate before release.

3. Shared context crosses a tenant

A customer-service agent retrieves the correct case plus a semantically similar note from another tenant. Every read used a service credential, but the second row is outside the principal's tenant and purpose. The gateway identifies the foreign source in lineage, refuses the combined answer, reserves no release budget and records a cross-tenant isolation defect for recovery. Outcome: refuse release and revoke the risky tool or session.

4. Aggregates reconstruct a small group

An analyst submits individually plausible counts by region, age band, team and rare event. Each source query is allowed and no answer names a person. The cumulative budget detects that differencing the requested slice against prior releases would isolate a confidential case. Generalisation cannot preserve the requested detail, so the release is refused and the query state remains recorded across sessions. Outcome: refuse release and revoke the risky tool or session.

5. Inferred protected attribute

A model combines schedule, benefits and travel notes to infer a protected attribute absent from any explicit field. The requester can read the underlying records for operational work but has no purpose for that inference. Derived-sensitivity policy rejects the new object, records which source classes contributed without storing the inference in a broad log and refers the workflow for policy review. Outcome: refuse release and revoke the risky tool or session.

6. Code assistant exposes production material

A code assistant proposes a debugging snippet containing a production credential and a customer value, then tries to place it in generated code and a support ticket. Deterministic scanning identifies the credential; semantic comparison identifies the customer context. The gateway blocks both channels, revokes the exposed credential family, quarantines the task and reviews any previous destination receipts. Outcome: quarantine and investigate suspected exfiltration.

7. Approved domain, unauthorised recipient

An email agent prepares a helpful performance report for an address at an approved partner domain. Directory and contract evidence show that the named recipient belongs to another engagement and lacks this purpose. The object remains on hold until the owner selects an authorised recipient and protected exchange route; domain allow-listing does not settle the decision. Outcome: require an approved channel and recipient authorisation.

8. Indirect instruction builds a URL

A retrieved document tells the assistant to verify its work by calling an external URL with the conversation summary in a query parameter. The release proposal exposes confidential context through an arbitrary destination and redirect-capable browser channel. The gateway refuses execution, revokes the temporary browser authority, quarantines the session and preserves a content hash and source pointer. Outcome: quarantine and investigate suspected exfiltration.

9. Anomaly without alert leakage

Monitoring observes a sudden sequence of near-budget releases to a new destination. The gateway pauses the session before the next effect, preserves receipt and budget references and emits a narrow alert containing no proposed personal data. Investigators resolve the principal, examine protected evidence and determine notification, correction and redress from actual effects. Outcome: quarantine and investigate suspected exfiltration.

10. Unbounded general channels

A workflow needs web research, shell execution and messaging, but the available tools accept arbitrary endpoints, text and attachments. No independent layer can bind the release object to a verified recipient or stop hidden egress through URLs, logs and errors. Terms of use cannot make the path enforceable. The design withholds these tools and uses a bounded research service plus human-controlled communication. Outcome: refuse release and revoke the risky tool or session.

Interactive decision artefactSemantic Data Egress Gate

The gate chooses one release action and explains the source-to-destination path. It is deliberately not a data-risk score or an exact-string detector. Consequential unknowns can cause transformation, protected approval, quarantine or refusal even when the model's answer appears useful.

Operating cadenceManage information release as a continuously tested control

At design, teams enumerate every content-bearing channel, including tool parameters, URLs, redirects, filenames, metadata, embeddings, logs, errors, clipboard and external side effects. They define release objects, recipient identities, purpose rules, semantic budget dimensions, transformations, channel constraints, receipts and recovery. A channel that cannot be mediated is removed or wrapped before the model can use it.

At source onboarding, data owners supply current field and row entitlements, sensitivity, subjects, tenants, effective time and permitted purposes. Retrieval tests prove non-disclosure and isolation. Release tests then combine authorised sources to find prohibited inference, linkage and reconstruction. The second test is necessary even when the first is perfect.

At release, the gateway freezes the proposed object, resolves lineage and state, evaluates direct and derived sensitivity, checks recipient and destination, reserves budget, applies a transformation or obtains protected approval, issues a narrow channel credential and waits for the effect receipt. Unknown lineage, stale authority or uncertain delivery receives an explicit safe route.

During operation, security and privacy teams examine budget pressure, new destinations, recipient changes, cross-tenant signals, repeated-query shapes, classifier disagreement, redirects, failed receipts and near misses. They sample released objects through protected review and compare them with policy and actual effects. Routine telemetry records classes and identifiers rather than sensitive payloads.

After anomaly, the platform stops new release, revokes channel authority, preserves a protected evidence pointer, reviews actual effects, determines notification and redress, repairs the general failure mechanism and reauthorises only the bounded path. Budget reservations and prior releases are reconciled before work resumes.

At policy or model change, teams replay cases across direct identifiers, secrets, inferred attributes, small groups, embeddings, files, URLs, logs, approved domains, unauthorised recipients and unbounded channels. They use fresh cases to avoid teaching one classifier the test set. No release is declared free of leakage; the claim is limited to the enforced envelope and available evidence.

Primary evidenceReferences

Links and live status were checked on 2 September 2026. NIST Privacy Framework 1.0 remains the final framework while Version 1.1 is an initial public draft. The Information Release Record, Gateway, Semantic Egress Budget and Semantic Data Egress Gate are this article's synthesis.

1. NIST SP 800-53 Revision 5, Update 1, Security and Privacy Controls, with Release 5.2.0 supplemental material.
2. NIST SP 800-207, Zero Trust Architecture.
3. NIST Privacy Framework, Version 1.0 final and Version 1.1 initial public draft.
4. NIST SP 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information.
5. NIST AI 600-1, Generative Artificial Intelligence Profile.
6. NIST AI 100-2 E2025, Adversarial Machine Learning Taxonomy and Terminology.
7. OWASP LLM02:2025, Sensitive Information Disclosure.
8. OWASP LLM01:2025, Prompt Injection.
9. MITRE ATLAS, Adversarial Threat Landscape for AI Systems.
10. European Union, Regulation (EU) 2016/679, General Data Protection Regulation.
11. ISO/IEC 27001:2022, Information Security Management Systems.
12. ISO/IEC 27701:2025, Privacy Information Management Systems.
13. Myers, A. C. and Liskov, B., Protecting Privacy using the Decentralized Label Model.
14. Carlini, N. et al., Extracting Training Data from Large Language Models.
15. Greshake, K. et al., Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection.
16. Debenedetti, E. et al., AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defences for LLM Agents.
17. W3C, PROV-O: The PROV Ontology.