Positive Data Control: A Secure Architecture for LLM-Mediated Data Governance

Positive Data Control: A Secure Architecture for LLM-Mediated Data Governance | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article Positive Data Control: A Secure Architecture for LLM-Mediated Data Governance Shames AL Mandalawi, Muzakirruddin Ahmed Mohammed, Mert Can Cakmak, and 1 more This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-9317019/v1 This work is licensed under a CC BY 4.0 License Status: Under Review Version 1 posted 6 You are reading this latest preprint version Abstract Modern data governance relies on formal access control and documented policies, yet enforcement remains challenging in dynamic environments where users issue natural language data requests. Large Language Models (LLMs) offer semantic interpretation capabilities, but granting them direct access to sensitive data introduces risks such as prompt injection, malicious query generation, and unintended exposure.This paper presents a zero-knowledge governance architecture, where the LLM never sees actual data values, in which requests are interpreted using metadata, policies, and permissions, while deterministic validation and sandboxed execution enforce authorization. The LLM is treated as an untrusted component and does not constitute the enforcement boundary. We formalize the threat model, implement a prototype, and evaluate it across a comprehensive set of governance and adversarial scenarios. Results show correct policy decisions and successful prevention of unauthorized or injection-style access within the evaluated suite, without data-value exposure to the LLM. The findings demonstrate that architectural separation between semantic interpretation and data execution enables secure automated governance consistent with established information security principles. Data governance Large Language Models Access control Zero-trust architecture Policy enforcement Text-to-SQL security Prompt injection Defense-in-depth Secure system architecture Positive Data Control Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Under Review Version 1 posted Reviewers agreed at journal 05 May, 2026 Reviewers agreed at journal 02 May, 2026 Reviewers invited by journal 29 Apr, 2026 Editor assigned by journal 04 Apr, 2026 Submission checks completed at journal 04 Apr, 2026 First submitted to journal 03 Apr, 2026 You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-9317019","acceptedTermsAndConditions":true,"allowDirectSubmit":false,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":634736202,"identity":"f5a21ac8-c25c-491f-98b2-9b459ed507fd","order_by":0,"name":"Shames AL Mandalawi","email":"","orcid":"","institution":"University of Arkansas at Little Rock","correspondingAuthor":false,"prefix":"","firstName":"Shames","middleName":"AL","lastName":"Mandalawi","suffix":""},{"id":634736203,"identity":"6344b26a-6e5e-4f54-9e2f-eece7aff72c7","order_by":1,"name":"Muzakirruddin Ahmed Mohammed","email":"","orcid":"","institution":"University of Arkansas at Little Rock","correspondingAuthor":false,"prefix":"","firstName":"Muzakirruddin","middleName":"Ahmed","lastName":"Mohammed","suffix":""},{"id":634736204,"identity":"51d96fec-a0d8-45ca-9e35-db8e3abac39d","order_by":2,"name":"Mert Can Cakmak","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAAvUlEQVRIiWNgGAWjYJACxgYGBgN+IH0AyiFSiySQIFGLwQFitei2H374cWaOnbHxjeQHhysYbGQ3HCCgxexMmrHkxm3JZmY30gwOnmFIMyas5QYPg+TDbcw2ZjcSDA42MBxOJEYL88+H2+ptjGekfwBq+U+UFjagww6bGUjkgGw5QISWM2lmljO3HTeWOPOm4GCDQbLxTIJajh9+fLN3W7Vhf3v6xocNFXayfYS0oAED0pSPglEwCkbBKMABADHMSuBV8JMBAAAAAElFTkSuQmCC","orcid":"","institution":"University of Arkansas at Little Rock","correspondingAuthor":true,"prefix":"","firstName":"Mert","middleName":"Can","lastName":"Cakmak","suffix":""},{"id":634736205,"identity":"db464d03-7ff7-414f-96a8-fb8556bf62a8","order_by":3,"name":"John R Talburt","email":"","orcid":"","institution":"University of Arkansas at Little Rock","correspondingAuthor":false,"prefix":"","firstName":"John","middleName":"R","lastName":"Talburt","suffix":""}],"badges":[],"createdAt":"2026-04-04 02:53:10","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-9317019/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-9317019/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":108806214,"identity":"bda9361e-c65d-4d39-baa7-92ba314c42b2","added_by":"auto","created_at":"2026-05-08 15:28:01","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":329448,"visible":true,"origin":"","legend":"","description":"","filename":"PositiveDataControlAZeroKnowledgeArchitectureforLLMMediatedDataGovernanceIJIS2026.pdf","url":"https://assets-eu.researchsquare.com/files/rs-9317019/v1_covered_733b827c-2007-4c90-bed0-d8e2e8cd7429.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"Positive Data Control: A Secure Architecture for LLM-Mediated Data Governance","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":false,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"international-journal-of-information-security","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"ijis","sideBox":"Learn more about [International Journal of Information Security](http://link.springer.com/journal/10207)","snPcode":"10207","submissionUrl":"https://submission.nature.com/new-submission/10207/3","title":"International Journal of Information Security","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"em","reportingPortfolio":"Springer Hybrid","inReviewEnabled":true,"inReviewRevisionsEnabled":false},"keywords":"Data governance, Large Language Models, Access control, Zero-trust architecture, Policy enforcement, Text-to-SQL security, Prompt injection, Defense-in-depth, Secure system architecture, Positive Data Control","lastPublishedDoi":"10.21203/rs.3.rs-9317019/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-9317019/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"Modern data governance relies on formal access control and documented policies, yet enforcement remains challenging in dynamic environments where users issue natural language data requests. Large Language Models (LLMs) offer semantic interpretation capabilities, but granting them direct access to sensitive data introduces risks such as prompt injection, malicious query generation, and unintended exposure.This paper presents a zero-knowledge governance architecture, where the LLM never sees actual data values, in which requests are interpreted using metadata, policies, and permissions, while deterministic validation and sandboxed execution enforce authorization. The LLM is treated as an untrusted component and does not constitute the enforcement boundary. We formalize the threat model, implement a prototype, and evaluate it across a comprehensive set of governance and adversarial scenarios. Results show correct policy decisions and successful prevention of unauthorized or injection-style access within the evaluated suite, without data-value exposure to the LLM. The findings demonstrate that architectural separation between semantic interpretation and data execution enables secure automated governance consistent with established information security principles.","manuscriptTitle":"Positive Data Control: A Secure Architecture for LLM-Mediated Data Governance","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2026-05-07 08:29:57","doi":"10.21203/rs.3.rs-9317019/v1","editorialEvents":[{"type":"communityComments","content":0},{"type":"reviewerAgreed","content":"95035567596064523112079795492876654969","date":"2026-05-05T10:50:10+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"78517923206494830976035454965835063687","date":"2026-05-02T18:23:58+00:00","index":"hide","fulltext":""},{"type":"reviewersInvited","content":"","date":"2026-04-29T09:58:04+00:00","index":"","fulltext":""},{"type":"editorAssigned","content":"","date":"2026-04-04T07:13:30+00:00","index":"","fulltext":""},{"type":"checksComplete","content":"","date":"2026-04-04T07:13:01+00:00","index":"","fulltext":""},{"type":"submitted","content":"International Journal of Information Security","date":"2026-04-04T02:44:17+00:00","index":"","fulltext":""}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"international-journal-of-information-security","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"ijis","sideBox":"Learn more about [International Journal of Information Security](http://link.springer.com/journal/10207)","snPcode":"10207","submissionUrl":"https://submission.nature.com/new-submission/10207/3","title":"International Journal of Information Security","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"em","reportingPortfolio":"Springer Hybrid","inReviewEnabled":true,"inReviewRevisionsEnabled":false}}],"origin":"","ownerIdentity":"e37ee7ea-52d3-486b-896b-4449373326b7","owner":[],"postedDate":"May 7th, 2026","published":true,"recentEditorialEvents":[{"type":"reviewerAgreed","content":"95035567596064523112079795492876654969","date":"2026-05-05T10:50:10+00:00","index":15,"fulltext":""},{"type":"reviewerAgreed","content":"78517923206494830976035454965835063687","date":"2026-05-02T18:23:58+00:00","index":14,"fulltext":""}],"rejectedJournal":[],"revision":"","amendment":"","status":"under-review","subjectAreas":[],"tags":[],"updatedAt":"2026-05-07T08:29:57+00:00","versionOfRecord":[],"versionCreatedAt":"2026-05-07 08:29:57","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-9317019","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-9317019","identity":"rs-9317019","version":["v1"]},"buildId":"XKTyCvWXoU3ODBz1xrDgd","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}