Enterprise Generative Search — Azure and Open Source  ·  View 39 of 41  ·  Assurance

Sensitive Data and Tenant Isolation

Classified once at ingest, enforced everywhere afterwards by a filter.

Editable source SVG draw.io All views
Detected once, at ingest Detectors Presidio recognisers names, ids, accounts Purview label read authored by the business Internal identifier patterns curated regexes Written to the chunk classification public to restricted pii_kinds[] for redaction rules Enforced at retrieval and display Retrieval Classification ceiling per request from the caller, not the query Restricted sources excluded unless the class allows them Display Redaction at render never in the index Reveal is an audited action with a reason Constrained in generation Model handling No tenant data in prompts to shared models beyond the evidence slot No training or fine-tuning on content contractual and technical Abuse-monitoring retention disabled approved exemption Logging Traces store ids, not text passages by reference Prompt capture is opt-in and time-boxed Isolation between business units and regions Boundaries tenant field on every chunk filter, never a convention Separate index for regulated units physical, not logical Customer-managed keys per unit revocable Subject rights Erasure removes chunks and traces within 30 days Provenance keeps the reference not the content Source systems remain the record for a subject access request Sensitive Data and Tenant Isolation Classification is decided once, at ingest, and enforced everywhere afterwards by a filter. Deciding it at query time would make every new consumer a new security review. v 1.0 · owner Data and AI Global Practice

Decisions

  • Classification is decided once, at ingest, and written onto the chunk. Deciding it at query time would make every new consumer a new security review, and would put a model in the path of a security decision.
  • Redaction happens at render, never in the index. Redacting at index time destroys retrievability for people who are entitled to see the content.
  • Traces store identifiers rather than passage text. Otherwise the trace store becomes a second copy of the corpus with different permissions and a different retention.

Isolation

  • Business units are separated by a tenant field that is a filter, not a naming convention. Regulated units get a physically separate index and customer-managed keys.
  • Erasure removes chunks, representations and trace bodies within 30 days and keeps the provenance reference without content, so the record that an answer was given survives the content it cited.

Assumptions and risks

  • Abuse-monitoring retention on Azure OpenAI is disabled under an approved exemption. Without it, prompts containing evidence would be retained outside our control.
  • Purview labels are assumed present and accurate on regulated content. Where they are absent the platform falls back to the source's own classification, which is coarser and is reported as a coverage gap.
◀  Untrusted Content and Prompt Injection All views Governance and Audit  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 41 views · Microsoft Azure and open source39-sensitive-data-and-isolation