Where Does Your AI Data Really Live?
The 7 AI data control points across 6 deployment topologies
A few days ago, I wrote about the six AI deployment topologies that exist across modern enterprises — from tenant SaaS GenAI to embedded ML buried inside legacy systems.
The follow-up questions almost all landed in the same place:
“Okay — so which topology is safest? Which is easiest to audit? Which should we standardize on?”
Fair questions. Just not the first one. Because most organizations already know where their AI runs. Very few know where their AI data goes — or how many times it changes form along the way.
Traditional governance assumes data stays put. A document stays a document. A record stays a record — owned, classified, access-controlled, retained.
AI quietly demolishes that. In an AI system, a single document becomes:
Document → Dataset → Embedding → Context Window → Model Input → AI Output → Business Record
At every arrow, something can fall off: ownership, classification, access controls, retention, regulatory scope.
This is why mature programs still struggle with AI. They were built to govern files. AI requires governing transformations.
So an AI application inventory — “we use ChatGPT Enterprise, Copilot, Bedrock, an internal RAG app” — tells you where AI exists. It tells you almost nothing about where AI risk exists.
For that, you need a different map.
Here’s the shift the infographic is built around. For each control point, in each topology, the question isn’t “is it there?” It’s “who can see it, and who controls it?”
That gives you four states — and as an auditor, this is the part I would tattoo on the back of my hand:
* Full Presence — The data lives here and you can govern and test it directly.
* Partial Presence — It may exist depending on your architecture. (“It depends” is not an audit conclusion — go find out.)
* Hidden / External — It exists, but the provider controls it. You can’t test it. You can only get assurance over it.
* No Presence — It isn’t used in this topology. (A gift — scope you get to remove.)
Most AI risk conversations stop at “exists / doesn’t exist.” The maturity jump is recognizing that “exists but hidden behind a vendor” is a completely different posture than “exists and is yours.” One you test. The other you can only attest to.
Hold that thought through the seven control points.
1. Source Systems — ERP, CRM, email, SharePoint, databases, SaaS apps. Where the data begins, and your home turf — encryption, RBAC, DLP, classification. The risk: those controls stop here while the data keeps moving. The source is protected; the copies are not. Full Presence across all six topologies. Remember that — so is the last control point. The bookends are always yours; everything between them is where topology decides what you can see.
2. Aggregation Layer — Data lakes, warehouses, Snowflake, Databricks, Microsoft Fabric. Where data is combined at scale — and where access quietly broadens beyond any single source. The model doesn’t care where a field came from; it consumes whatever it can reach. Full when you own the platform, Partial for SaaS GenAI, embedded vendor SaaS, edge, and legacy. Partial is your cue to ask the architecture question, not assume the answer.
Get Miguel O Villegas | Founder iSecurePrivacy LLC’s stories in your inbox
Join Medium for free to get updates from this writer.
3. AI Development & Training — Jupyter, SageMaker, Databricks ML, Vertex AI Workbench. Where models get built and fine-tuned — and, ironically, often the least-governed environments you own, because everyone treats them as temporary. They aren’t. Sensitive training copies outlive the experiment by years. This is where the lens earns its keep: for self-hosted open weights and embedded ML in legacy it’s Full Presence — your problem. For tenant SaaS GenAI and embedded vendor SaaS it’s Hidden / External — the training is real, you just can’t test it. Two topologies, same control point, completely different audit strategy.
4. Retrieval & Knowledge Layer — Pinecone, Weaviate, Azure AI Search, OpenSearch, vector stores. The engine room of RAG — and a problem traditional security has never faced. Access control was built around documents; retrieval operates on embeddings. The uncomfortable question: can a user retrieve information derived from a document they were never allowed to open? Note the right side of the matrix — for edge AI and legacy ML this is No Presence. No vector store, no embedding-leakage risk. That’s not a gap to close; it’s scope you can confidently strike.
5. Prompt & Context Layer — User prompts, system prompts, conversation history, agent memory, cached context. The fastest-growing blind spot. For many organizations this is where regulated data and IP first enter the AI system — not through a pipeline, but through someone typing it into a box, before any traditional control sees it. Full wherever there’s a conversational interface, No Presence for legacy ML — your old fraud model takes features, not prompts. So if you’re scoping prompt monitoring, the legacy estate is off the list.
6. Model Artifacts — Fine-tuned models, LoRA adapters, checkpoints, embedding models, eval artifacts. The asset everyone forgets is an asset. A model trained on sensitive data becomes sensitive — the training set may be gone, but the knowledge persists in the weights. The pattern is sharp: Full for self-hosted and legacy, Hidden for SaaS GenAI and embedded vendor SaaS. Rule of thumb — you own the model-governance problem exactly when you own the weights.
7. Production AI & Outputs — Copilot responses, generated reports, agent actions, generated code, API outputs. Where executives focus, but where the journey ends, not starts. Every output spawns something new — a record, an email, a decision, a line of code. The risk: those outputs become brand-new datasets that need governance of their own. And like Source Systems, Full Presence across all six topologies.
Step back and look at the shape, not the cells. The first and last control points are green everywhere. Where data enters and where it leaves is always yours. It’s the five in the middle that flicker between green, amber, blue, and gray — and that flickering is the risk profile of your AI estate.
* Green is what you test.
* Amber is what you investigate.
* Blue is what you can only get assurance over — and where audit is hardest.
* Gray is what you take off the table.
Read any single column top to bottom and you’ll see the real job. Tenant SaaS GenAI: bookends are yours, the middle is mostly Partial or Hidden — so your program is a third-party assurance exercise. Self-hosted open weights: almost everything is Full — the burden lands entirely on you. Same seven control points, radically different jobs. That’s what the six topologies were always about.
Most teams can answer “what AI tools are we using?” Far fewer can answer “where does our AI data transform — and at each point, can we test the control or only attest to it?” The first gives you a catalog. The second gives you a program.
You don’t have to boil the ocean to start. Pick one regulated or sensitive dataset and trace it across all seven control points in one topology. Mark each point green, amber, blue, or gray. By the time you reach Outputs, you’ll have found at least one transformation where ownership, classification, or access quietly evaporated. That single trace will tell you more about your real AI risk than any tool inventory.
Because in modern AI environments, the model is the easiest thing to find.
The data is what disappears.
As AI shifts from answering to acting, agentic systems don’t escape this map — they stretch it. Agent memory persists across sessions long after the prompt is gone. Tool calls reach into the source, aggregation, and retrieval layers at runtime. And agent actions don’t just create records — they create transactions.
In other words: agentic AI has a data footprint of its own — often a larger one. Every control point above still applies; agents just touch more of them, faster, and with less human in the loop.
That deserves more than a paragraph, so I’m giving it its own treatment. A dedicated article on agentic AI data is coming next in this series.
Don’t just inventory your AI tools. Map your data. Protect it at every control point.
What’s the first control point where your own data trace breaks down? I’d genuinely like to hear it.
Follow-on to my recent piece on the six AI deployment topologies. If you’re standing up an AI governance, security, audit, or compliance program, the seven control points — and the four presence states across them — may be a more useful map than any model catalog.
Originally published at https://www.linkedin.com.
Before you go
- Please take a moment to like the post and follow the writer!
- Did you know that over 400,000 developers share what they’re building, learning, and discovering across our platforms every month? Learn how you can contribute here
