The AI Data Governance Framework: A Five-Stage Control System for the Data Boundary in AI Systems

Counts differ because each database indexes a different set of publications. We treat OpenAlex as the canonical count; Google Scholar is not shown (no API, and crawling it violates its ToS).

An institution asked whether a particular item of data may be inside a particular AI system usually answers from recollection. Someone remembers which extract the training set came from, someone else remembers that the extract excluded a restricted field, and a third person remembers that the exclusion was agreed with the data owner who has since left. The answer is often correct. It is never evidence. This specification states the control system that makes the same answer come from a record. It operates in five ordered stages. Classify determines, per data set, its sensitivity under a declared scheme, its personal-data status, and the residency clauses that reach it. Bound fixes the residency rule set, the clauses the institution may not cross, each traced to a primary instrument and dated. Prove constructs the lineage graph from an attested source through every transformation to the point of use. Gate applies the quality thresholds, the minimization check and any certification claimed. Release admits the data with a BOE Declaration attached, or does not admit it. Two rules do the work that keeps a rule set honest over time. Every clause carries a re-verification date, and a clause relied on after that date is not a clause; the rule set's review date must not be later than the earliest re-verification date among its clauses. And an undated verification is not evidence that one occurred. A residency rule set is the kind of artifact that ages quietly into fiction, because a clause sourced once and never revisited looks exactly like a clause that is still true. It is entry REG-03 of the Defensible AI Framework Registry, and the worked treatment of the data boundary class defined in A Pattern Language for Production LLM Platforms, which specifies and governs that class. Residency is named here as a member of that class rather than as a class of its own. The deposit publishes residency-rule-set-schema-v1.0.json, a JSON Schema (draft 2020-12) for a residency rule set and for the selection made against it. The registry records the absence of a machine-readable classification schema as the single largest gap in this entry. Section 8 closes it, and closes the corresponding gap in the consuming framework in the same object, because a rule set expressed once and read from both ends cannot drift. Two copies would. The rule set is authored here at the Bound stage; the selection object is authored by the Cross-Border AI Architecture Patterns and references clause identifiers rather than restating clauses. What the specification does not claim is stated plainly rather than left to inference. No institution unconnected to the author has been observed operating the five stages as specified here, and there is no implementation profile, no scored instrument and no published result: a validated file is not a populated one. The attestation cost has not been measured anywhere, and the framework's cost sits almost entirely in the per-hop attestation, so that is recorded as an unmeasured quantity rather than a manageable one. The schema has no adopters, and a schema with no adopters is a proposal. And the schema's limits are real: it cannot tell a person from a committee, resolve an identifier, check uniqueness across a document, compare a stated union against a computed one, order a date against the earliest of many, or establish that a cited instrument exists. A passing validation satisfies one of the seven requirements it supports and part of a second. A pass is not a check. It is also not a statement of any residency or transfer rule. This specification names no jurisdiction and states no legal obligation; clauses are the institution's to source, date and re-verify. That is why its reference list carries no statute or supervisory instrument: the document advances no proposition about what any of them requires, and a specification supplying clauses would be supplying the one thing it has no standing to supply and the one thing that ages fastest. It is not a certification scheme.