Abstract

In the 2018 Cambridge Analytica scandal, personal data that people had shared for one purpose was reportedly collected through a third-party app and combined into psychological profiles used for political targeting. No vault was broken. Individually accessible data was joined and repurposed beyond what anyone agreed to.

Enterprise AI now recreates that pattern at machine speed. Assistants and agents are being connected to customer, engineering, source-code, supplier, financial, HR, scheduling and memory systems. Every connection may be permitted, yet by linking fragments an AI workload can build what no system stores: an unreleased product, a launch date, a merger target, or a profile of an employee or customer. Unless the joining of data is technically controlled and regulated, a compromised agent, a careless integration or a third-party AI with broad connectors can quietly produce a Cambridge Analytica 2.0 inside any company or across its partners.

Frontier models alone cannot prevent this. A more capable model is better at connecting dots, not worse. Guardrails, system prompts and alignment run inside the same software the workload controls, so prompt injection or compromise can bypass them. No model can enforce authority it does not hold. Connector permissions, encryption and separate databases protect each source, not the relationships between sources. Without cryptographically enforced separation that companies and partners can verify, enterprises will keep their most valuable data away from even the best models.

This disclosure separates the authority to access information from the authority to associate it:

  • Separate protection domains. Identity data, content, relationship-mapping information, keys and authorisation state are held in independently controlled protection domains.
  • Scoped, non-bearer authorisation. Each request receives a session-bound authorisation stating exactly which fields and relationships may be joined, for which purpose and under which epochs.
  • Independent release. Each vault decides for itself whether to release its part, and released components cannot be reused as bearer data.
  • Minimum-necessary joins. Only the permitted relationships are formed, inside a protected reconstruction domain, as a temporary minimum-necessary view.
  • Release control for results. A generated answer or proposed tool action stays non-effective until current state is re-verified, a protected receipt is committed, and a single-use release capability is consumed at a mandatory release boundary.

The test is simple: if the AI workload is compromised but the association authority is not, the protected relationship must stay unavailable. The architecture is presented as 79 Implementation and Functional Profiles, with pseudocode, formal invariants and a runnable reference implementation.

Industry relevance (AI-generated). The disclosure addresses the enterprise-AI deployment class, in which assistants and agents are connected to many business systems at once. Publicly described examples of that class include:

  • Microsoft 365 Copilot and Copilot Studio
  • Google Gemini Enterprise and Agent Gateway
  • OpenAI ChatGPT Enterprise and Work
  • Anthropic Claude for enterprise and the Model Context Protocol
  • Amazon Q Business and Amazon Bedrock
  • Salesforce Agentforce and the Einstein Trust Layer
  • ServiceNow AI Agents
  • xAI Grok for Business

It is also relevant to confidential-computing platforms, such as NVIDIA GPU confidential computing and BlueField DPUs, and to attested AI cloud processing, such as Apple Private Cloud Compute, as possible hosts for protected reconstruction and release boundaries. It further concerns builders of MCP servers, retrieval-augmented generation pipelines, enterprise search, data clean rooms and AI governance tooling. Its regulatory context includes GDPR purpose limitation and data minimisation, EU AI Act data-governance, logging and cybersecurity duties, trade-secret protection, and DORA and NIS2.

These products and companies are named only as publicly described examples of where technical non-joinability and execution finality could apply. Naming them does not allege that any product is vulnerable, deficient, non-compliant or infringing. It does not describe any undisclosed internal architecture, and it does not imply that equivalent protections are absent. This industry-relevance material, including the Cambridge Analytica comparison, is AI-generated. Readers must cross-check it against the original PCT filings and each company’s own current documentation before drawing any conclusion.

This technical disclosure is based on the Mothership application PCT/IB2026/055615, filed 4 June 2026 and publicly disclosed 16 July 2026 (WO 2026/150382). That application claims priority from PCT/IB2026/053385, filed 7 April 2026 and publicly disclosed 4 June 2026 (WO 2026/115520). The profile details are as published in Internet-Draft draft-das-enterprise-ai-enforcement-profiles-01 on 19 September 2026. Related family applications can be cross-checked on WIPO PATENTSCOPE.

Licensed under CC BY-NC 4.0. The author is open to acquihire or strategic collaboration.

Keywords

Cambridge Analytica 2.0; enterprise AI security; data aggregation risk; purpose laundering; technical non-joinability; access is not association; frontier model limits; Microsoft 365 Copilot; Copilot Studio; Gemini Enterprise; ChatGPT Enterprise; Claude; Model Context Protocol; Amazon Q Business; Amazon Bedrock; Agentforce; Einstein Trust Layer; ServiceNow AI Agents; Grok for Business; confidential computing; RAG security; MCP security; semantic join control; output finality; non-bearer capability; zero trust; GDPR; EU AI Act; trade secrets; machine enforcement.

Creative Commons License

Creative Commons License
This work is licensed under a Creative Commons Attribution-Noncommercial 4.0 License

Download

Share

COinS