DataGovernance.ca editorial · 13 October 2026 · Implementation guidance
Begin with permission and purpose
Before building an index, decide what the application is meant to do and who it serves. Record the intended source, its owner and the basis on which the organisation may use it for the proposed task. Access to a system does not, on its own, settle every reuse or disclosure question. Put unresolved questions into an approval backlog rather than treating ingestion as approval. These are design prompts; the relevant owners and specialists must determine the actual permissions.
Keep access attached to the information
Think through a realistic scenario: two employees ask the same question, but only one is entitled to see a confidential source. Document what the implementation should return to each person, and how the permission is checked. Do not assume that copying data into a search or vector index preserves its original access controls. Include permission changes and user offboarding in the test scenarios.
Plan for correction and removal
Source information changes. Assign an owner for refresh frequency, document replacement, access revocation and removal requests. Identify derived copies, caches and indexes that may need attention. Decide how the application should behave when a source is stale, disputed or unavailable. Make the boundary visible to the team running the pilot rather than hiding it in a technical backlog.
Hand off to AI system governance
Data readiness supports the wider AI review; it does not replace it. Keep the approved source register, access requirements and evaluation cases together so the AI use-case owner can examine the remaining risks. NIST describes its AI RMF as voluntary and notes that version 1.0 is being revised. A framework reference is not a certification. The practical output is a reviewable handoff, not an “AI-safe” badge.
Rehearse a withdrawn source—not just a successful answer.
Use a fictional, non-sensitive source document in an approved test environment. Record its permitted purpose, user boundary and current version. Plan a replacement and withdrawal. Identify the indexes, caches or derived copies that the implementation must review, and keep unresolved behaviour in the use-case handoff.
The record should identify the scope, owner, evidence, unresolved questions and next review. It is a draft exercise—not evidence that your organisation has implemented or passed the control.