An AI data inventory should name every important data object, why the system uses it, where copies exist, who can access it, how long it remains and how deletion propagates. “Customer documents go to an AI model” is too vague to operate or review.
Build the inventory around system paths and stored artifacts. The model is one processor in that map, not the entire system.
Use a row per data object and purpose
Start with objects that an engineer or business owner can recognize: source email, extracted text, prompt context, model response, tool arguments, approval draft, run record, trace, usage event, export and backup.
For each row, record:
| Field | Question |
|---|---|
| Data object | What exact record, file, field set or derived artifact exists? |
| Purpose | Which defined system function needs it? |
| Source | Which user, application or system produced it? |
| Owner | Who decides the business purpose and access? |
| Processor | Which service stores or transforms it? |
| Location | Which environment, region or account contains a copy? |
| Access | Which roles and services can read or change it? |
| Retention | Which event starts the clock and what removes it? |
| Deletion | How does erasure reach derived records and backups? |
| Evidence | Which test or query proves the entry remains true? |
Split one row when the same source has two purposes with different access or retention. An email body used for a short-lived model request and a durable approval record are different inventory entries.
Trace copies across the complete data flow
Follow one hypothetical request from entry to deletion. A file uploaded by a user may appear in object storage, extraction memory, a search index, model-provider input, a trace, a cached response and a backup.
Draw arrows only where data actually moves. A connector reference is not the same as a copied record. A map that says “data stays in the source system” becomes false as soon as content is retrieved into model context or operational logs.
For Skybridge systems, the release path records sources, destinations, provider routes, run evidence and retention for the contracted perimeter. Connector output is shaped so only the fields needed for the task enter context.
Inventory derived and operational data
Teams often document source files and forget the artifacts created by the AI system. Include summaries, classifications, embeddings, extracted metadata, approval notes, model traces and usage records.
Derived data can still be sensitive. A short summary may reveal health, employment or commercial information even when the original document is absent. Tool arguments may contain the recipient and substance of an external action.
Operational evidence needs its own minimization decision. Store enough to diagnose and prove the run, while excluding secrets and fields that do not serve that purpose.
Connect identity and permission to the inventory
For every object, identify the workspace, role and service account that can access it. Do not use “admins” as one undifferentiated group. Platform operators, workspace administrators, approvers, readers and support personnel can have different needs.
Test authorization at retrieval time. A user who once created a record may no longer belong to the workspace. An approval link may outlive the reviewer's permission. Background jobs need scoped identities too.
Skybridge uses workspace membership profiles to separate administrative, operating, approval and read-only actions. The inventory should show which data each permission exposes, not only which buttons the role can click.
Make retention executable
“Delete when no longer needed” cannot be tested. Define a duration or event, the deletion job, exception path and verification query.
Different evidence can have different lifetimes. Detailed model events may use a shorter window because they contain user and tool context. Daily operating aggregates can remain longer when personal identifiers have been removed. Approval evidence may follow the life of the business action it supports.
Run deletion before aggregation where the design requires it, and confirm that personal fields do not leak into the long-lived table. Record job failures and rerun behavior.
Test erasure across weak relationships
Foreign keys can cascade deletion through obvious tables. Analytics, usage and event tables sometimes store identifiers without a database relationship so ingestion remains independent. Those rows can survive account deletion unless application logic removes them explicitly.
Create a test identity, generate every relevant artifact, execute the deletion path and query every inventory location. Include search indexes, object storage, pending approvals, usage events and exports. Document backup expiry separately from active-store deletion.
The test should fail when a new table appears without an inventory row or deletion decision.
Keep provider and transfer records connected
The inventory should link each external processor to its purpose, data categories, account, region and contractual record. Model routing matters because two agents in the same interface may use different providers or customer-supplied keys.
Do not infer a region or retention policy from a vendor logo. Verify the contracted plan and exact service path. Recheck when a connector, model route or hosting configuration changes.
Turn the inventory into release evidence
Review the inventory during system design, before real data enters a new path and after material releases. The owner of each change should answer whether it adds a data object, provider, location, purpose or retention path.
NIST's AI RMF includes an outcome for maintaining an AI system inventory and calls for documented roles and ongoing monitoring. The NIST AI RMF Core is a useful governance reference, while this article focuses on the technical data map beneath that inventory.
In Skybridge, versioned change records and architecture reviews help connect the documented map to the running system. Continue with the versioned changelog guide and the architecture runtime audit.
Continue reading: What to test in a tool-using AI application.