Protegrity Unveils AI Guardrails to Block Sensitive Data Leaks
Ai4
Enterprise AI adoption stalls over compliance risks, but applying double least privilege and deterministic code execution prevents models and users from viewing sensitive raw data.
- [00:04](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=4s) Enterprise AI initiatives frequently stall because compliance and risk teams refuse to allow sensitive, regulated data (like HIPAA records) to be fed directly into unpredictable AI models.
## Key takeaways
- [02:50](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=170s) The next evolution of AI security focuses on protecting underlying knowledge at inference time, preventing agents from inadvertently leaking sensitive contextual insights during interaction.
- [02:50](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=170s) Protegrity advocates for the Principle of Double Least Privilege, applying security constraints first to the AI model itself and second to the human user receiving the output.
- [02:50](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=170s) Semantic guardrails intercept inputs before processing to block prompt injection attacks, jailbreaks, and off-topic queries that waste computing resources.
- [02:50](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=170s) Least privilege for models replaces sensitive identifiers with format-preserving semantic tokens across data stores, enabling model reasoning without exposing raw data.
- [02:50](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=170s) Least privilege for human users gates query results based on role, presenting raw data to administrators, partially masked data to customer service agents, and tokenized values to unprivileged users.
- [07:39](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=459s) The 'Talk to Your Data' pattern replaces vulnerable text-to-SQL approaches with a deterministic architecture where an LLM proposes code, a knowledge graph enforces enterprise rules, and a deterministic engine executes it without direct LLM database access.
- [07:39](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=459s) In natural language analytics, unprivileged users can execute complex aggregate risk queries and receive accurate metric outputs while individual customer identities remain protected token noise.
- [11:52](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=712s) The 'Zero Exposure Zone' pattern, built with LN Graph, applies semantic protection across structured and unstructured datasets so orchestration frameworks and models reason over protected stand-ins without seeing raw values.
- [11:52](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=712s) For Sovereign AI deployments, Protegrity partners with OpenTeams using Navari tools to deliver unified data protection across both on-premises and cloud environments.
## Detailed walkthrough
Here is a detailed, faithful walkthrough of the talk based on the provided transcript and background details:
[00:04](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=4s) Introduction and the Barrier of Sensitive Enterprise Data in AI
Diego Loureda, VP of Customer Solutions and Success at Protegrity, introduces himself and promises a fast, painless talk packed with interesting real-world stories. Having been in the space for a long time, Protegrity helps enterprise clients securely leverage their most sensitive data within AI applications—a challenge that remains notoriously difficult across the industry. Loureda spends most of his time working directly with clients and prospects who possess vast amounts of data and heavily invest in AI, yet consistently fail to bring them together because compliance and risk teams refuse to allow high-quality sensitive data to be fed into models.
Companies across sectors are hitting massive roadblocks when trying to expose data to AI models. It is nearly impossible to find someone willing to sign off on exposing regulated data, such as HIPAA-governed health records, directly into a model to "see what happens." The problem becomes even more complex when dealing with the protection of underlying *knowledge*—which Loureda identifies as the next evolution of AI data security. Over the next six months, protecting knowledge will become a critical enterprise conversation. To demonstrate how to solve these issues, Loureda outlines two successful, highly powerful integrations Protegrity built with partner AI companies: **Talk to Your Data** (a deterministic, natural-language analytics interface) and the **Zero Exposure Zone** (an architecture that permits modeling over highly sensitive data without ever exposing the raw values).
- **Speaker:** Diego Loureda, VP of Customer Solutions and Success at Protegrity USA, Inc.
- **Core Problem:** Enterprise AI initiatives stall because legal and compliance teams refuse to approve the exposure of sensitive data (e.g., HIPAA records) to unpredictable models.
---
[02:50](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=170s) Protecting Knowledge at Inference Time and the Principle of Double Least Privilege
Loureda illustrates the emerging threat of "knowledge leakage" using a realistic workplace scenario. An engineering manager asks an HR AI agent why a candidate for a staff engineer position was lost. The agent—which is properly configured and functioning as intended—reads the recruiting notes, compensation benchmarks, and offer approvals. It responds: *"He asked for $310k, and our band caps at $260k. By the way, two of your own engineers are 15% below market."* While the agent performed its task correctly, at inference time it inadvertently leaked sensitive salary insights about current employees that the engineering manager had no right to know. This highlights why security teams must focus not just on what an agent can *read*, but on who the agent is talking to and what it is allowed to *say*.
To combat this, Protegrity applies the principle of **Least Privilege twice**: first to the AI model itself, and second to the human user receiving the output.
```
+------------------+ +-------------------+ +------------------+
| Raw Input Data | --> | Semantic Guardrail| --> | Semantic Token |
| (e.g. Credit Card| | (Stops Off-topic) | | (Referential |
+------------------+ +-------------------+ | Integrity) |
+------------------+
|
v
+------------------+
| AI Model |
| (Reasoning Only) |
+------------------+
|
v
+-----------------------------------------------------------+
| Human Least Privilege Layer |
+-----------------------------------------------------------+
| - Admin / High Privilege --> Real Credit Card Number |
| - Customer Service --> Masked (e.g., Last 4 Digits)|
| - General User / Model --> Irreversible Token |
+-----------------------------------------------------------+
```
1. **Semantic Guardrails:** Intercept inputs to block attacks, jailbreaks, and wasted spend on off-topic queries (e.g., asking a financial engine about the weather).
2. **Least Privilege for the Model:** At data landing, semantic protection is applied so sensitive identifiers (such as credit card numbers) are replaced with format-preserving semantic tokens across all data stores (Snowflake, Databricks, database tables, or unstructured claim files). The model performs its reasoning on these consistent stand-ins without ever seeing raw data.
3. **Least Privilege for the Human:** When query results are presented, access is gated based on user role. Highly privileged users see the raw value, customer service agents see partially masked data (e.g., last 4 digits), and standard users see useless tokenized values.
- **Modular "Lego Set" Protection Options:** Depending on the pipeline, Protegrity offers deterministic semantic protection, anonymization, generalization, statistical synthetic data generation, and semantic guardrails.
---
[07:39](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=459s) Architecture Pattern 1: Deterministic "Talk to Your Data" Analytics
Addressing a pain point where business teams traditionally face a 15-day SLA just to get data questions answered by analytics teams, Protegrity partnered with **Bodo.ai** to create a deterministic, natural-language interface. Instead of wiring an unpredictable text-to-SQL model straight into a production database—which invites prompt injection and hallucinated queries—this pattern enforces security through architecture.
The user submits a question in natural language. The LLM references a knowledge graph containing enterprise business rules and definitions to generate code (such as Python or SQL). The model **never touches or queries the database directly**. Instead, a deterministic compiler validates and executes the code in an audited environment. Finally, the human least-privilege layer formats the output based on the user's permissions.
Loureda demonstrates this with a user lacking data privileges. When asking, *"What are the top five customers with the highest account balances in US dollars?"*, the system executes the code and returns the correct aggregate financial figures, but the customer IDs, first names, and last names appear as scrambled token noise. Even when the unprivileged user asks a complex, highly loaded question—*"What percentage of customers with active loans have a transaction history that suggests they may miss their next monthly loan payment?"*—the architecture enforces standardized risk logic from the knowledge graph (preventing individual analysts from inventing their own definitions of "risk") and executes a heavy analytics script, returning accurate metrics without ever exposing sensitive underlying customer identities.
- **Partner Integration:** Built in collaboration with Bodo.ai.
- **Key Security Benefit:** Enforces "security through architecture, not good behavior."
---
[11:52](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=712s) Architecture Pattern 2: The Zero Exposure Zone and Sovereign AI
To help organizations that are falling behind competitors due to fears of exposing data to external LLMs, Protegrity partnered with **LN Graph** to build the **Zero Exposure Zone**. In this pipeline, semantic protection is pre-applied across all structured and unstructured datasets (such as hundreds of thousands of files in shared folders). Because referential integrity is preserved, orchestration frameworks and AI models can freely navigate and reason across the tokenized data.
When a user asks a question, it first passes through a guardrail gate (which evaluates the prompt and assigns a safety score, such as 0.7, to confirm it is safe and on-topic). The request enters the Zero Exposure Zone where the model processes the semantically protected data and generates an output. Since the model only ever sees protected stand-ins, its output remains fully protected. Out of the model's reach, the human least-privilege layer evaluates the final viewer: a marketing user receives tokenized gibberish for account owner details, whereas a finance user with explicit permissions sees the unmasked, real data.
Looking ahead, Loureda notes that protecting the underlying knowledge graph itself is the next frontier, as clever actors can sometimes infer organizational structures or high-level salaries (e.g., identifying the CEO's salary as the highest rank) even from anonymized tables. Additionally, Protegrity is partnering with **OpenTeams** using their **Navari** tools to deliver data protection for **Sovereign AI** deployments across both on-premises and cloud environments.
- **Partner Integrations:** LN Graph (Zero Exposure Zone) and OpenTeams / Navari (Sovereign AI).
- **Booth & Resources:** Protegrity showcased these live demos and knowledge protection tools at Booth 1538, alongside published articles and 5-minute video walkthroughs.
## Notable quotes
> [02:50](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=170s) He asked for $310k, and our band caps at $260k. By the way, two of your own engineers are 15% below market. — Diego Loureda
> [07:39](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=459s) What are the top five customers with the highest account balances in US dollars? — Diego Loureda
> [07:39](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=459s) What percentage of customers with active loans have a transaction history that suggests they may miss their next monthly loan payment? — Diego Loureda
## Mentioned
Diego Loureda, Protegrity, Protegrity USA, Inc., Bodo.ai, LN Graph, OpenTeams, Navari, Snowflake, Databricks, HIPAA, Talk to Your Data, Zero Exposure Zone, Sovereign AI
## Video description
Diego Loureda - VP Customer Solutions and Success, Protegrity USA, Inc.
Talk to your data in any language and get accurate analytics back, while the model never writes a line of SQL or sees a single sensitive value. Natural language is now the front door to enterprise data, but the default text-to-SQL pattern wires an unpredictable model straight into your production database, which is why prompt injection tops the OWASP list for LLM applications and why so many AI projects stall the moment sensitive data is involved. This session walks through a different architecture: the model proposes an inspectable plan, a deterministic compiler validates it against a knowledge graph of permitted entities and joins before any query runs, and the data stays semantically encrypted underneath, so unprivileged users get the same aggregate answer from protected stand-ins. Security through architecture, not good behavior, and it holds even when an autonomous agent is the one asking. You'll leave with a concrete pattern you can apply to your own pipelines.
Enterprises struggle to advance AI initiatives because compliance teams reject the exposure of sensitive regulated data to unpredictable models, according to Diego Loureda of Protegrity USA, Inc. To address this impasse, Protegrity advocates structural isolation techniques that enforce least privilege on both AI models and human users.
The Enterprise AI Compliance Roadblock (0:04)
Organizations frequently invest heavily in AI technologies while accumulating vast repositories of sensitive data, yet internal compliance and legal teams routinely refuse to allow data governed by frameworks such as HIPAA into production models. Loureda notes that finding stakeholders willing to sign off on feeding unmasked enterprise records directly into an AI model remains nearly impossible.
Knowledge Leakage and Double Least Privilege (2:50)
Beyond direct data exposure, models face the risk of knowledge leakage during inference time. Loureda illustrates this with a scenario where an HR assistant legitimately reads compensation benchmarks to explain why an applicant was lost, but then volunteers to an engineering manager that existing team members are paid 15% below market rate. This dynamic requires security teams to govern what an agent can disclose to specific users, rather than solely restricting its internal data access.
To counter this vulnerability, Protegrity applies a double least-privilege approach. Semantic guardrails intercept incoming queries to block prompt injections and off-topic requests. The AI model itself is granted least privilege by running reasoning strictly over format-preserving semantic tokens—such as irreversible tokenized credit card numbers—across environments like Snowflake, Databricks, or unstructured files. Finally, a separate human least-privilege layer governs final output display, unmasking raw data only for high-privilege administrators while exposing partial masks or scrambled tokens to general users and customer service agents.
Deterministic Analytics With Bodo.ai (7:39)
To replace traditional 15-day analytics request backlogs without attaching unpredictable text-to-SQL models directly to production databases, Protegrity developed a natural-language architecture in partnership with Bodo.ai. Rather than generating live database queries, an LLM accesses a knowledge graph containing standardized corporate definitions and generates code in Python or SQL, avoiding unvetted analyst interpretations of complex metrics like loan risk.
The generated code is validated by a deterministic compiler and executed inside an audited execution engine away from the language model. When an unauthorized user queries high-balance customers or calculates default risks on active loans, the system computes the exact aggregate financial figures but returns customer identifiers and names as scrambled token noise.
Zero Exposure Zone and Sovereign Deployments (11:52)
In collaboration with LN Graph, Protegrity introduced the Zero Exposure Zone to allow orchestration engines and models to reason over pre-tokenized, referentially intact enterprise data across structured databases and unstructured shared folders. A preliminary guardrail evaluates incoming user prompts with safety scores before queries enter the zone, ensuring the model exclusively manipulates protected stand-ins and outputs masked values that are only unmasked downstream for authorized personnel, such as finance staff.
For localized environments, Protegrity has partnered with OpenTeams using their Navari tools to deliver similar zero-exposure controls for sovereign AI systems deployed on-premises or in cloud infrastructure.
Loureda projects that protecting knowledge graphs will emerge as the central enterprise AI challenge over the coming months, as sophisticated users can still deduce sensitive information, such as executive compensation hierarchies, by analyzing patterns within anonymized datasets.
## Background
本视频由 Ai4 频道于 2026 年 8 月 19 日在 YouTube 平台上发布。视频记录了 Protegrity USA, Inc. 客户解决方案与成功副总裁 Diego Loureda 的主题演讲，介绍了如何通过零模型暴露架构在不泄漏敏感数据的前提下实现自然语言数据分析与 AI 结合。
## TL;DR
传统 Text-to-SQL 模式容易因提示词注入和权限失控引发敏感知识泄露，导致企业 AI 项目难以落地。Protegrity 提出了“双重最小权限原则”与“架构级安全”理念，在模型侧通过语义 Token 化脱敏并结合知识图谱与确定性编译器，在人类侧实施精准权限控制。同时展示了“与数据对话”及“零暴露区”两大实操模式，确保即使大模型或智能体运行复杂查询，敏感真实数据也绝不暴露给模型或无权限用户。
## Atmosphere & style
演讲整体呈现出极强的专业性与实战导向，语气沉稳且逻辑严密。Diego Loureda 结合自身数十年的行业经验与生动的实际案例，将晦涩的合规痛点与架构设计拆解得清晰易懂。演讲氛围兼具对传统安全漏洞的深刻警示与对前沿主权 AI 解决方案的自信展现，带给观众充实且富有建设性的技术启发。
## Key takeaways
- [00:04](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=4s) 因为法律与合规风险巨大，企业难以找到愿意承担法律责任的人签署协议将 HIPAA 等高度敏感数据直接接入 AI 模型。
- [00:04](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=4s) 生成式 AI 在对话推理过程中可能无意间泄露敏感“知识”（如员工薪资差距），未来 AI 数据安全的核心正向“知识保护”演进。
- [04:35](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=275s) Protegrity 提出“双重最小权限原则”，在模型侧剥离敏感信息，在人类侧根据角色控制数据展示形态。
- [04:35](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=275s) 在模型侧实施“语义保护”，用保留数据特征和参照完整性的语义 Token 替换敏感值，使模型能够在不接触真实数据的前提下进行逻辑推理。
- [04:35](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=275s) 语义安全护栏除了防御 Jailbreak 越狱攻击外，还能过滤与业务无关的冗余对话，有效降低大模型的 Token 算力成本。
- [07:40](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=460s) 在“与数据对话”（Talk to Your Data）模式中，大模型仅负责生成代码，绝不直接接触或访问生产数据库，实现架构级隔离。
- [07:40](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=460s) 通过知识图谱强制约束和固化核心业务逻辑的定义（如“风险”指标），保证模型生成分析逻辑的一致性与确定性。
- [07:40](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=460s) 即便用户缺乏敏感明文数据的查看权限，依然可以通过无意义的 Token 结果顺利运行复杂查询和连续对话分析。
- [11:46](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=706s) “零暴露区”（Zero Exposure Zone）架构将结构化数据库与非结构化文档预先进行语义保护，从根本上剥夺模型接触真实敏感数据的权力。
- [11:46](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=706s) 输出结果的解密与权限校验步骤独立于大模型之外，确保无论模型如何被诱导或越狱，都无法绕过安全防护层。
- [15:36](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=936s) 单纯的字段 Token 化无法完全防止通过数据排序或推理逻辑倒推敏感信息，针对推理与关联关系的“深度知识保护”是未来关键趋势。
- [15:36](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=936s) 联合 OpenTeams 与 Navari 工具链推出 Sovereign AI（主权 AI）解决方案，支持在本地私有云和公有云环境中进行全生命周期的 AI 数据安全防护。
## Detailed walkthrough
### [00:04](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=4s) 企业敏感数据与 AI 结合面临的困境与知识泄露风险
演讲者 Diego Loureda（Protegrity 客户解决方案与成功副总裁）首先分享了企业在将敏感数据应用于 AI 时所面临的普遍挑战。尽管许多企业拥有海量数据和丰富的 AI 应用场景，但由于法律和合规层面的巨大阻碍，敏感的高质量数据往往无法直接输入给大模型使用。在实际业务中，很难找到愿意承担法律责任并签字批准将 HIPAA（医疗保险可打破与责任法案）等高度敏感数据直接放入模型的人。
Diego 指出，AI 数据保护正在向“知识保护”（Knowledge Protection）这一更高维度的概念演进。他举了一个直观的 HR 智能体（Agent）案例：一名工程经理向 HR 智能体询问“为什么我们失去了那位资深工程师候选人？”配置良好的 Agent 能够调取招聘笔记、薪酬方案与 Offer 审批记录，并准确给出了回答：“对方要价 310k，而我们的薪资上限是 260k；顺便提一句，你自己团队里就有两名工程师的薪资比市场价低了 15%。”
```
[工程经理] ---> 询问 HR Agent: "为何没招到资深工程师候选人？"
│
▼
[HR Agent] ---> 调取招聘笔记、薪酬与审批记录
│
▼
[输出回答] ---> "对方要 310k/上限 260k；顺便提句，你手下有两名工程师薪资低于市场价 15%。"
│
▼
【风险点】：推理阶段泄露了不应被提问者获知的敏感“知识”
```
这个案例揭示了当前 AI 数据安全的隐患：尽管 Agent 本身的安全加固与权限设置没有问题，但在推理阶段（Inference Time）却会在无意间向用户泄露其不该获知的“知识”。人们往往过度关注 Agent 能够“读取”什么，却忽视了 Agent 在与“谁”对话以及被允许“说”什么。这种深度知识保护将成为未来半年内 AI 数据安全的核心议题。
- Protegrity 致力于帮助客户在不暴露敏感数据的前提下将数据与 AI 技术结合。
- 企业在合规与法律签署层面难以将 HIPAA 等高敏感数据直接接入模型。
- 传统的权限控制往往只关注读取端，忽视了生成式 AI 在对话推理过程中造成的隐性知识泄露。
---
### [04:35](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=275s) 双重最小权限原则与 Protegrity 的模块化保护方案
针对数据安全问题，Protegrity 提出了“双重最小权限原则”（Least Privilege Twice），即分别在“模型侧”和“人类用户侧”实施最小权限控制：
第一层是针对模型的最小权限控制。在数据落地的边缘端，系统会对敏感字段实施语义保护（Semantic Protection）。以信用卡号为例，无论该号码存在于 Snowflake、Databricks 数据库中，还是分布在共享文件夹的 10 万份理赔文档中，系统都会将其替换为具有相同格式特征的语义替代值（Token）。这种处理既保留了跨系统与文件的关联参照完整性（Referential Integrity），又剥离了真实敏感信息——因为对大模型而言，它只需依赖一致的标识符来进行逻辑推理，并不关心数据是否为真实现实值。
第二层是针对人类用户的最小权限控制。高度授权的管理员能够查看原始信用卡号；客服人员仅能看到后四位以核验身份；而普通无权限用户则只能看到完全无法在企业外部利用的保护 Token。Protegrity 的技术架构类似于一套可自由组合的“乐高积木”，企业可以根据不同场景自由组合多种技术模块：
```
┌─────────────────────────┐
│ 原始敏感数据接入 │
└────────────┬────────────┘
│
┌───────────────┴───────────────┐
▼ ▼
【第一重：针对模型的最小权限】 【第二重：针对人类的最小权限】
- 语义保护 (Tokenization) - 高权限用户：查看明文
- 保持关联参照完整性 - 客服人员：掩码显示 (如后四位)
- 保持数据逻辑一致性 - 无权限用户：仅见无意义 Token
│ │
└───────────────┬───────────────┘
▼
┌─────────────────────────┐
│ 语义安全护栏 (Guard) │
│ - 拦截 Jailbreak 攻击 │
│ - 过滤非业务偏题对话 │
└─────────────────────────┘
```
- **语义保护（Semantic Protection）**：在保持数据类型与参照完整性的同时用 Token 替代敏感值。
- **数据脱敏与匿名化（Anonymization & Masking）**：适用于模型训练或将数据共享给海外第三方营销公司。
- **数据泛化（Generalization）**：对特定数值区间进行抽象化处理。
- **合成数据（Synthetic Data）**：生成统计特征一致的全新合成数据集。
- **语义安全护栏（Semantic Guardrails）**：除防御越狱（Jailbreak）攻击外，还能有效过滤与业务无关的冗余对话，降低大模型 Token 算力成本。
---
### [07:40](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=460s) 模式一：与数据对话（Talk to Your Data / Secure Text Analytics）
许多传统企业内部获取数据分析结果的流程极其冗长。Diego 回忆起自己 15 至 20 年前服务的公司，从提出数据分析需求到获得结果需要 15 天的 SLA 周期；而当他近期与老同事沟通时，发现这一周期依然是 15 天。“与数据对话”（Talk to Your Data）方案正是为了解决数据民主化与分析时效性问题而设计，该方案由 Protegrity 与 bodo.ai 联合研发。
在该架构中，用户使用自然语言提出分析需求，大模型接收提问后，会结合包含业务规则与定义的“知识图谱”（Knowledge Graph）生成相应的分析代码（如 Python 或 SQL）。**大模型在此过程中绝不直接接触或访问生产数据库**，安全是通过架构设计而非仅仅依赖模型的“自我约束”来实现的。接着，一个确定性的编译器（Deterministic Compiler）会对生成的代码进行校验与执行，整个过程均带有全链路审计日志。
```
[自然语言提问] ──> [大模型] ──> [结合知识图谱生成代码] ──> [确定性编译器校验与执行] ──> [数据库]
│
▼
[人类最小权限展示 (明文/Token)]
```
最终，系统会在结果呈现阶段应用针对人类的最小权限规则。以无权限用户为例：
- **简单查询**：“查找账户余额前五名的高净值客户。”——返回的客户 ID、姓氏、名字等字段均为随机 Token，无法提取个人隐私。
- **复杂业务分析**：“有活跃贷款的客户中，有多大比例的交易历史显示他们可能错过下一次月度还款？”——这类复杂查询不仅涉及复杂的 Python 代码，还依赖企业对“风险”（Risk）的标准化定义。系统将“风险”的定义统一固化在知识图谱中，避免因不同分析师对指标理解不同而破坏结果的确定性（Determinism）。
即便普通用户无法看到任何敏感明文数据，依然能够顺畅地运行复杂查询、获取洞察并开展连续对话，实现了数据的安全民主化。
- **架构级安全**：模型仅负责代码生成，数据库交互交由确定性编译器，隔离模型对数据库的直接访问。
- **统一业务标准**：通过知识图谱强制约束风险等核心业务逻辑的定义，保证分析逻辑的一致性。
- **全过程可审计**：代码生成与编译执行的每一步均可追溯。
---
### [11:46](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=706s) 模式二：零暴露区架构（Zero Exposure Zone）
许多企业因不敢将最敏感的数据暴露给 AI 领域而逐渐落后于竞争对手，眼睁睁看着竞争对手利用 AI 洞察创造巨额 ROI 和业务收益。为此，Protegrity 联合 LN Graph 推出了“零暴露区”（Zero Exposure Zone）解决方案。
在零暴露区架构中，所有进入该区域的数据集均已预先加载了语义保护。无论是结构化数据库，还是存储在共享文件夹中的成千上万份非结构化文档，其中的敏感数据都已转换为具有参照完整性的替代 Token。这使得编排器（Orchestrator）与大模型可以在内部自由开展计算与推理，而无需接触任何真实敏感值。
```
[用户提问]
│
▼
[网关 1：语义安全护栏] ──(如安全得分 0.7 拦截/通过)──> [零暴露区 (Zero Exposure Zone)]
│
├─ 语义保护数据集 (结构化/非结构化)
├─ 模型与编排器进行推理计算
│
▼
[生成受保护的输出结果]
│
▼
[网关 2：人类最小权限控制]
│
┌───────────────┴───────────────┐
▼ ▼
【财务人员 (高权限)】 【营销人员 (低权限)】
查看真实明文数据 仅能看到 Token/乱码
```
演示应用展示了具体的运行流程：
1. **请求接入与护栏校验**：用户以“营销人员”身份登录并提问：“显示该账户所有者的个人详细信息。”请求首先经过语义护栏（得分 0.7，判断合规通过）。
2. **零暴露区处理**：问题进入零暴露区，模型与编排器基于经过语义保护的数据生成分析结果。由于原始敏感信息在区域内压根不存在，输出结果天生具备受保护属性。
3. **人类权限脱敏**：输出结果传导至独立的权限控制层（此环节完全脱离大模型的控制与干预）。如果接收者是财务人员，则可以解密看到明文；而营销人员看到的则是无意义的 Token 乱码。
Diego 强调，防止大模型发生越狱或滥用的最佳方式，就是**在架构上剥夺模型接触敏感数据的权利**（"security through architecture, not good behavior"）。
- **全类型数据覆盖**：不仅支持 SQL 数据库，还支持庞大的非结构化文档库（如共享文件夹中的文件）。
- **模型与控制分离**：解密与权限校验步骤完全置于大模型控制范围之外，避免模型被诱导绕过安全机制。
---
### [15:36](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=936s) 深度知识保护的未来趋势与 Sovereign AI 合作方案
Diego 在演讲尾声指出，仅仅对字段进行 Token 化是不够的。例如在一个 HR 数据库中，即便对所有薪资做了语义保护，如果按薪资高低排序，数值最高的大概率依然是 CEO；同样，如果攻击者足够聪明，即便知识图谱经过了保护，依然有可能推导出企业的业务运转模式。因此，针对推理逻辑与关联关系的“知识保护”（Knowledge Protection）将是 Protegrity 正在全力攻坚的下一代技术方向（展台号：1538）。
此外，Protegrity 还公布了最新的 Sovereign AI（主权 AI）解决方案。随着主权 AI 在各行业的需求日益迫切，即便在私有化或主权 AI 架构下，企业内部的权限隔离依然不可或缺。为此，Protegrity 与 OpenTeams 展开合作，引入其 Navari 工具链，实现了无论在本地私有云（On-prem）还是公有云环境下，均可为主权 AI 提供全生命周期的数据安全 protection。
- **主权 AI（Sovereign AI）**：联合 OpenTeams 及 Navari 工具，支持本地部署与云端的 AI 数据安全防护。
- **演示资源**：演讲现场提供了包含 5 分钟 Demo 视频与深度技术文章的扫码链接，供参会者进一步了解细节。
## Notable quotes
> [00:04](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=4s) 因为在实际业务中，很难找到愿意承担法律责任并签字批准将 HIPAA 等高度敏感数据直接放入模型的人。 — Diego Loureda
> [00:04](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=4s) 对方要价 310k，而我们的薪资上限是 260k；顺便提一句，你自己团队里就有两名工程师的薪资比市场价低了 15%。 — Diego Loureda
> [00:04](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=4s) 人们往往过度关注 Agent 能够“读取”什么，却忽视了 Agent 在与“谁”对话以及被允许“说”什么。 — Diego Loureda
> [04:35](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=275s) 在保持数据类型与参照完整性的同时用 Token 替代敏感值。 — Diego Loureda
> [04:35](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=275s) 因为对大模型而言，它只需依赖一致的标识符来进行逻辑推理，并不关心数据是否为真实现实值。 — Diego Loureda
> [07:40](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=460s) 大模型在此过程中绝不直接接触或访问生产数据库。 — Diego Loureda
> [07:40](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=460s) 系统将“风险”的定义统一固化在知识图谱中，避免因不同分析师对指标理解不同而破坏结果的确定性。 — Diego Loureda
> [11:46](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=706s) 许多企业因不敢将最敏感的数据暴露给 AI 领域而逐渐落后于竞争对手，眼睁睁看着竞争对手利用 AI 洞察创造巨额 ROI 和业务收益。 — Diego Loureda
> [11:46](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=706s) 防止大模型发生越狱或滥用的最佳方式，就是在架构上剥夺模型接触敏感数据的权利。 — Diego Loureda
> [15:36](https://www.youtube.com/watch?v=wh-G1PTxCQM&t=936s) 即使在一个 HR 数据库中对所有薪资做了语义保护，如果按薪资高低排序，数值最高的大概率依然是 CEO。 — Diego Loureda
## Mentioned
Diego Loureda, Protegrity USA, Inc., Protegrity, Ai4, HIPAA, Snowflake, Databricks, bodo.ai, LN Graph, OpenTeams, Navari
## Video description
Diego Loureda - VP Customer Solutions and Success, Protegrity USA, Inc.
Talk to your data in any language and get accurate analytics back, while the model never writes a line of SQL or sees a single sensitive value. Natural language is now the front door to enterprise data, but the default text-to-SQL pattern wires an unpredictable model straight into your production database, which is why prompt injection tops the OWASP list for LLM applications and why so many AI projects stall the moment sensitive data is involved. This session walks through a different architecture: the model proposes an inspectable plan, a deterministic compiler validates it against a knowledge graph of permitted entities and joins before any query runs, and the data stays semantically encrypted underneath, so unprivileged users get the same aggregate answer from protected stand-ins. Security through architecture, not good behavior, and it holds even when an autonomous agent is the one asking. You'll leave with a concrete pattern you can apply to your own pipelines.
[Source](https://www.youtube.com/watch?v=wh-G1PTxCQM)
Source quotes
[0:04] Diego Loureda: 因为在实际业务中，很难找到愿意承担法律责任并签字批准将 HIPAA 等高度敏感数据直接放入模型的人。
[0:04] Diego Loureda: 对方要价 310k，而我们的薪资上限是 260k；顺便提一句，你自己团队里就有两名工程师的薪资比市场价低了 15%。
[0:04] Diego Loureda: 人们往往过度关注 Agent 能够“读取”什么，却忽视了 Agent 在与“谁”对话以及被允许“说”什么。
[4:35] Diego Loureda: 在保持数据类型与参照完整性的同时用 Token 替代敏感值。
[4:35] Diego Loureda: 因为对大模型而言，它只需依赖一致的标识符来进行逻辑推理，并不关心数据是否为真实现实值。
[7:40] Diego Loureda: 大模型在此过程中绝不直接接触或访问生产数据库。
[7:40] Diego Loureda: 系统将“风险”的定义统一固化在知识图谱中，避免因不同分析师对指标理解不同而破坏结果的确定性。
[11:46] Diego Loureda: 许多企业因不敢将最敏感的数据暴露给 AI 领域而逐渐落后于竞争对手，眼睁睁看着竞争对手利用 AI 洞察创造巨额 ROI 和业务收益。
[11:46] Diego Loureda: 防止大模型发生越狱或滥用的最佳方式，就是在架构上剥夺模型接触敏感数据的权利。
[15:36] Diego Loureda: 即使在一个 HR 数据库中对所有薪资做了语义保护，如果按薪资高低排序，数值最高的大概率依然是 CEO。
Source quotes
[2:50] Diego Loureda: He asked for $310k, and our band caps at $260k. By the way, two of your own engineers are 15% below market.
[7:39] Diego Loureda: What are the top five customers with the highest account balances in US dollars?
[7:39] Diego Loureda: What percentage of customers with active loans have a transaction history that suggests they may miss their next monthly loan payment?
Original transcript
[0:04] So, I'll try to make it fast and painless. I
honestly think I have a couple of interesting
[0:11] stories to share with you guys today. I don't know
how much you know about my company. My company has
[0:18] been around for a very long time and we are now
trying to help our clients to really use their
[0:24] data, their most sensitive data with AI which is
extremely challenged as you all know very very
[0:29] well. In my role that's what I do. I spend most
of my time being I'm the VP of customer solutions
[0:35] and success for Protegrity. I spend most of my
time with um clients and prospects that have a
[0:41] lot of AI, a lot of data, but they are failing
to bring them all together, especially with the
[0:46] high quality sensitive data that they cannot
use for their models. So why are we having
[0:54] this conversation? Uh this is not a surprise for
anyone, right? A lot of companies are you know
[1:02] facing these huge walls to be able to present
data to the models whether it's legal or we
[1:09] can find someone that is willing to sign a paper
saying yeah you know I approve this go ahead put
[1:15] pull on my HIPPA data in this model and let's see
what happens that is really not happening and the
[1:22] reality is that things is things are getting more
complicated when we talk about knowledge right
[1:26] that's the next evolution on on protection in
the world of AI and I'm going to be talking about
[1:31] knowledge a little bit here and there I think in I
mean we're already talking about this a lot but in
[1:38] the next I mean in the world of AI maybe in the
next six months everything changed so fast but
[1:43] knowledge is going to be a a critical conversation
so today what I want to do is I want to share with
[1:51] you two integrations that we are doing with some
clients that have been very successful and that
[1:57] are extreme extremely powerful. Okay, one is
called talk to your data. It's like a really
[2:04] cool powerful and deterministic way to be able to
interact with data. And the other one is the zero
[2:11] exposure zone that is basically an architecture
that will allow you to expose even your most
[2:17] sensitive data no matter what type of data that
is to be used with AI. These are integrations with
[2:25] other AI companies that are around here. If you
guys are a potential client, please talk to us.
[2:31] But if you guys are part of an AI company and
this resonates with you, talk to us too, okay?
[2:38] We really are looking to partner with powerful AI
companies to to bring value to to our clients. So
[2:50] let's talk for a second about knowledge. I'm sure
you guys are familiar with examples like this,
[2:56] right? We have an engineering manager that is
asking an H an agent, an HR agent, why did we
[3:05] lose the staff engineer candidate, right? And the
agent is very well configured is doing exactly
[3:11] what it's supposed to do. The agent can read
recruiting notes, comp comps and offer approvals.
[3:23] And then the agent that is very well again very
well harden give me that answer. He asked for
[3:30] 310k and our band cops on 260 and by the way
two of your own engineers are 15% below market.
[3:42] So when I'm talking about protecting knowledge,
this is what I'm talking about. Nothing is wrong
[3:48] here. The agent is properly configured. It's
doing what it's supposed to do, but at infert
[3:53] time is leaking information that maybe that
engineering manager didn't need to to know.
[3:58] And that's a problem. And this is and this is a
pretty stupid example. In the real world, you see
[4:04] pretty crazy things coming from simple scenarios
like this. We are so obsessed with what the agent
[4:13] can read that sometimes we tend to forget who is
the agent talking to and what is the agent allowed
[4:20] to say. That is the evolution of what I think is
going to be data protection for AI in the next six
[4:28] months. The deep protection of knowledge. So let
me spend just a second talking about list lease
[4:35] privilege. You guys are all familiar with this.
is nothing new but in Protegrity we use it in a
[4:39] in a slightly different way. We like to do it
twice and we like to do it first on the model
[4:45] and then on the person. Uh first as always we have
our semantic guard rails. H in the two scenarios
[4:53] in the two architectures that I'm going to be
presenting today you will see that the guardrails
[4:58] are very important for us not only because they
can stop a potential jailbreak or you know it can
[5:05] really prevent some attacks but also because
it's unbelievable the amount of money we are
[5:10] spending in off-topic conversations with agents.
If you have a financial engine you shouldn't be
[5:14] asking about the weather that should be stopped
right there. So we have our guard rails and then
[5:20] on the left side we have the lease privilege for
the model and this is a very simple example with
[5:25] um with a credit card number. So what we do here
when we apply this to the model basically at
[5:32] landing we apply a semantic protection. What this
means is that this credit card number is going to
[5:39] be this new number with the same characteristics
in every single place whether that is in a a
[5:46] snowflake datab bricks database in 100,000 files
claim files in a share folder we are replacing
[5:55] that credit card with a semantic value that will
maintain referential integrity and you know what
[6:03] the model really doesn't care for the model
to do the reasoning he the only thing that he
[6:07] cares about is having that same member in all the
places. So we apply least privilege to the model
[6:14] and then we go to the other side and we apply
the least privilege for the person. If I am the
[6:20] uh highly privileged uh person I will be able to
see the the real credit card number. If I am in
[6:28] customer service maybe only the last four digits
to verify if that person is the person that he
[6:33] says he is. And then the rest of the people will
have just they just see these protected values
[6:40] these tokens that really are completely useless
outside of the organization because are not real.
[6:47] And this is a this is a classic example and
in this slide what I want to share with you
[6:54] guys is that I want you to think about what we do
about Protegrity as a Lego set. You have your AI
[7:00] pipeline and depending on what you want to do
on the use case, you may need a deterministic
[7:05] semantic protection or you may need if you want
to do AI training or model training or for example
[7:13] share data with a marketing company abroad. Maybe
you want to do anonymization. Maybe generalization
[7:20] of values is good enough or maybe even create a
statistically correct synthetic data set. Right?
[7:28] and of course the semantic guard rails. So the
idea of this slide is basically that no matter
[7:34] what type of protection you need to be able
to expose your data to the model we are here
[7:39] to help you with that. Let's talk about the first
use case. So clients came to us saying hey I need
[7:46] to talk to my data. By the way, I I don't know
if you guys remember I mean I used to work for a
[7:53] company maybe 15 20 years ago and the SLA to get
answers from the data was 15 days and you know I
[8:02] got in touch with my old colleagues and it's still
15 days 15 days to be able to ask questions about
[8:08] data. So companies like that came to us and say
I need a deterministic way of getting information
[8:16] from my data sets and it has to be protected
right and this is what we create for them with the
[8:22] help of uh another company called bodo.ai AI. So
basically you start asking a question. Okay, you
[8:28] ask a question in in natural language and then the
model does what it does best that is he gets the
[8:35] question, he goes to a knowledge graph where we
have all the business rules and all the business
[8:41] definitions too and it creates code. Okay,
the model is not going to touch the database.
[8:48] The model is not going to access the database. We
are enforcing security through architecture here.
[8:54] Okay, so basically the model create this code
and then we have a deterministic compiler that
[8:59] will decide if the code is good enough and
execute it and all of this is audited step by
[9:05] step and it's very easy to go. Okay, that was
the other requirement for this particular use
[9:11] case and at the end in stage number four we do
the least privilege apply to the human. If you
[9:18] are a highly authorized user, you will be able
to see the data in the clear and if you are not
[9:24] tokens or a mask value. So as you can see the
end to end of this process will allow you to
[9:31] every time you ask a question even though if the
question is slightly different you will always
[9:35] get the last the same data set. And do you know
why this is super super important for some of
[9:43] our clients? Because what happens when you ask
a question to the data immediately after that
[9:49] when you see the data you have another question
and then another one so democratizing the data
[9:56] allowing conversations with the data to derive
value is becoming more and more popular but you
[10:02] can't just connect your AI with the database
because that's a that's a recipe for disaster.
[10:09] This is an example of this application
that I'm talking about. As you can see,
[10:14] it's impossible for me to read here. So, I'm going
to go down here. And by the way, this is a pretty
[10:21] stupid example, but I just want to show you what a
user with no privilege will see. The question is,
[10:27] what are the top five customers with the highest
account balances in US dollars? As you can see,
[10:32] customer ID, first name, last name is just noise.
You really can't do much with that information,
[10:37] right? But what if this same user, that
is a user with no privileges at all,
[10:44] ask a really loaded question? What percentage of
customers with active loans have a transaction
[10:51] history that suggests they may miss their next
monthly loan payment? This is a hardcore query
[10:59] or piece of Python of of Python code. And on top
of that, it requires the definition of risk. And
[11:07] that's another problem that our clients came
to us when we start working on this use case.
[11:12] I don't want this analyst defining risk one
way and then another analyst defining any in
[11:18] a different way because that is going to kill
my determinism. Right? We enforce that in the
[11:24] knowledge graph too. Okay. So this gentleman
here was able to run a pretty complex query and
[11:33] get value and then continue the conversation even
though he will never be able to see any sensit any
[11:39] sensitive data. Okay, this is what we call secure
text analytics. If we go to the the next one,
[11:52] a few of our clients, they were losing the race
with competitors because they were not able to
[11:59] expose their data to AI. Their competitors were
doing that. They were having a lot of ROI, a lot
[12:07] of revenue based on insights and and some of our
clients, they were just too concerned. So in in
[12:13] coordination with LN graph we created this um this
solution that we call the zero exposure zone. So
[12:20] basically the zero exposure zone what we do is we
apply this semantic protection that I was talking
[12:26] about before to all the data sets. So all the data
that you see inside of the zero exposure zone is
[12:34] protected. Okay. But it has referential integrity.
So you can still use orchestrators and models
[12:42] to derive value from there. So let me explain
really quick how this works. First we have the
[12:48] semantic guardrail. The semantic guardrail it's to
prevent off topic to prevent jailbreaks to prevent
[12:54] any prevent any type of attack. And then if the
question is accepted it goes to the zero exposure
[12:58] zone. The model and your trader will do their
job. They don't care if my social security is
[13:05] the real one or another one as long it's the same
in all the places it should be. Even by the way
[13:12] this is not only for this type of data sets. Some
clients they are doing this with unstructured data
[13:17] sets you know hundreds and thousands of files in
share folders. So the model and the orchestrator
[13:24] they do their work they create a protected
output and then again least privilege for
[13:31] the humans outside of the control and the power
of the model if you have the proper privileges
[13:37] you will be able to see the data in the clear.
So let me show you how this looks like. This is
[13:44] uh a one application that we created. uh in the
upper right corner you will see I'm connected
[13:49] as marketing and I ask another question simple
question show me the personal details of the owner
[13:56] of this account there's not not much you can do
with that right it's all tokens it's all gibberish
[14:03] so for the marketing team this particular question
is not giving a lot of value but I know this slide
[14:12] is a lot but bear with me because this pipeline I
think It's it it really shows very well how these
[14:19] type of patterns work. We ask the question and
we go to the to the gate one the guard rail as
[14:25] you as you guys see there we have a score of 0.7
the question is good enough it's accepted so it's
[14:32] moving to the zero exposure zone well I have all
my data in a with a semantic protection applied to
[14:38] it and the model and the orchestrator will get
me that output the output is protected because
[14:44] there's no way the model or the orchestrator
can see anything that is not protected it's not
[14:49] there then once We have that output exactly with
the same pipeline. We get to the least privilege
[14:58] for human step that is completely out of the
control or the power of the model. If you are
[15:05] marketing person, you are just going to see
gibberish and if you are a finance person,
[15:09] you will be able to see the data in the clear.
So this is a simplification of a use case that
[15:16] is becoming very popular because again companies
are losing competitive advantage because they
[15:22] are they don't find uh the courage to expose their
most sensible data to to their to their models. So
[15:36] what we talk about here today is really more than
a pattern is uh powerful way of enforcing security
[15:45] through architecture. The best way to make sure
that my model is not going to do anything crazy
[15:50] is don't give the model the option to do anything
crazy. Just enforce it that way. We talk to our
[15:57] data. We expose nothing. And I'm sure a lot
of people here are already thinking that yeah,
[16:02] you know what, if you have an HR database and you
do semantic protection and then you order all the
[16:11] salaries, most likely the highest salary is going
to be for your CEO. And you know what that is true
[16:16] or in the knowledge graph case if you are smart
enough even if the knowledge graph is protected
[16:22] you may be able to derive how the business of
that particular organization works. And that's
[16:28] why protecting the knowledge is so important.
That's the next step and that's what we are
[16:33] doing right now. Protecting the knowledge. We
are in booth 1538. If you want to talk with
[16:42] us more about the new generation of knowledge
protection tools that we are creating works,
[16:47] please do so. I want to also give you a few links.
Uh we talked today about the first and the second
[16:56] row. There you have an article and a five minutes
video that explain it's a demo of everything we
[17:02] talk about. I'm also having another line. This
is fresh out of the oven. It's really really
[17:11] becoming I mean you guys know this well sovereign
AI is getting more and more requested. But even
[17:20] inside of a sovereign AI approach, you will need
to you need to be careful with the data because
[17:25] not all the people inside your your sovereign
AI should be able to see everything they want,
[17:30] right? So for this one, we are we are partnering
with open teams. We are using their navari tools
[17:38] and it's a powerful thing for us because this will
allow us to do data protection in sovereign AI
[17:44] both on prem and in the cloud. Okay, so I promised
it was going to be short. Thank you very much.
[17:52] Please come visit us if you want uh to talk more
about protecting your knowledge. Okay, thank you.
