Operate, Don't Replicate: Methodological Leakage in Enterprise AI — From Authorized Access to Unauthorized Inference

Counts differ because each database indexes a different set of publications. We treat OpenAlex as the canonical count; Google Scholar is not shown (no API, and crawling it violates its ToS).

Security guidance for enterprise AI deployments is framed almost entirely around controlling access: to data, to system instructions, to tools, to documents. This paper identifies a related but distinct failure mode. A retrieval-grounded agent can infer and articulate a transferable design methodology from operational content it was legitimately authorized to read. No document, prompt, or credential crosses a security boundary. The exposed asset is a synthesis generated by the model, not an artifact it retrieved. We name this methodological leakage, distinguish it from system-prompt leakage, document extraction, and general IP leakage, and propose an operate/replicate authorization boundary: the agent may explain and support execution of an existing process, but may not generalize, reconstruct, or provide instructions for replicating the design behind it. We introduce the inference boundary as a governance construct complementary to the access boundary. We report a ten-case adversarial validation protocol covering operational queries, direct and softened methodology extraction, abstraction, proxy-mediated requests, and instruction override. We state the limitation plainly: this is an instruction-layer control, which authoritative guidance correctly declines to treat as a security boundary. It closes the most convenient extraction channel and raises reconstruction cost; it does not eliminate inference. The structural control is corpus-layer separation of operational from methodological knowledge. The broader argument is that enterprise AI governance must evaluate not only what an agent may read, but what transferable method it may derive from what it is permitted to read. Note on scope: All examples are presented in abstracted, organization-agnostic form. No proprietary process content, client data, organizational identifiers, or methodology internals are disclosed. AI disclosure: The author used a generative AI assistant for language editing, structural organization, and literature positioning. All conceptual contributions, the observed case, the control specification, and the validation protocol are the author's own. The author reviewed and takes full responsibility for the content.