Vet connections

Connections between systems accumulate quietly. A retrieval plugin, a data export, a shared drive, and an integration a vendor switched on each open a path that no one reviewed as a whole. Connection authorization treats each path as something that must be granted, and it closes the ones that were never granted. Under the penalty regime cited below, a disclosure to a tool that is not the organization's business associate is a violation in itself. Closing the ungranted path prevents that disclosure.

In the Lab, this lever closes four pathways: the model repeating contaminated records as fresh output, records copied between systems, client data pasted into an unsanctioned tool, and records copied outside the governed system. It also holds down the pathway by which AI models or agents relay failures to one another.