Four Vocabularies, One Platform

The thesis, stated so it survives what you already know#

The merger is real in engineering, but partial and asymmetric, and the corpus shows the asymmetry by accident. Sensitivity labels have a rich set of enforcement consumers — DLP conditions, encryption, retention, conditional access, third-party apps via the Information Protection SDK. Catalog classifications largely do not: what the data map produces feeds discovery, stewardship, and a separate policy plane (Purview Data Policy / Data Use Management, gating access to sources by requester role), not the DLP plane.

Two policy planes, one per vocabulary, each complete on its own side. In the Crash Course e-book — the one document laying out the whole portfolio — "Discover, label, and protect" and "Deploy DLP policies" are Steps 1 and 2 of the same section, with nothing saying the second consumes the first. The entire bridge between the governance pillar and the protection pillar is a hyperlink parked under the Data Map: "Learn more about how data is classified with Microsoft Purview Information Protection." The seam, rendered as a link.

So the operator question is not whether the merger is real. It is which classification artifacts have an enforcement consumer today, and which are stranded. Labels: consumed. Data-map classification results, lineage edges, glossary terms: consumed by catalog-side access policy and by humans, not by the DLP path.

The inherited words: records, retention, eDiscovery#

The oldest layer — records management, legal hold, retention labels, eDiscovery, audit logs, communication compliance — assumes the obligation is external and dated: someone asks, you produce. "Audit trails" and "Data Protection Officer" appear only inside customer quotes, never in the vendor's voice; the oldest dialect is now spoken mainly by buyers. eDiscovery is the only capability enumerated as system actions on artifacts — preserve, collect, analyze, review, export, plus deep indexing and near-duplicate detection. Other documents enumerate too, but as program stages for humans. Only eDiscovery is specified as machine behavior, because courts audit that pipeline and nobody audits a DLP policy.

The regimes live here: roughly nine binding instruments across the two financial-services documents, plus four voluntary frameworks and one executive order — and the AI-specific instruments are almost all the non-binding kind. Every one is named, none described; no obligation, threshold or notification clock appears anywhere, GDPR's 72 hours included. Judgment: regulation here is a deadline generator, not a specification. Hence the swings — the 2025 flagship builds its entire second challenge on regulation and names no statute at all.

Trace the obligation the corpus never traces. GDPR Article 17: erasure is demanded, and the record sits in a lakehouse table, a derived feature table, a fine-tuned checkpoint, and a vector index. Lineage resolves the first two when the transformation ran through an instrumented engine, cannot reach the checkpoint at all, and reaches the index only if someone modeled embedding generation as a lineage edge. That one obligation turns lineage from reporting into a control.

The catalog words: annexed, and stranded on the wrong side#

Your dialect was annexed wholesale; "governance" became the first pillar of a security portfolio. Classification is the damaged word, but the interesting half is not the naming collision you already see. It is the consumer side.

Freshness is the real seam, not vocabulary. A scan is periodic and eventually consistent; a policy decision is synchronous and answers in the request path. An enforcement point cannot block on a catalog lookup, and a catalog result is stale by construction. So the handoff is manual: a human reads a classification in the catalog and authors a policy against a label.

Two facts for your specialty. "Sensitivity label" as a phrase appears nowhere in 156 pages — the corpus says "label" and "classify" and lets the reader supply the referent. And lineage appears exactly twice, both under discovery, never under compliance or evidence. My judgment is that provenance belongs on the compliance side; the material has not had that thought.

The failure mode is a program reporting the corpus's own 85% "properly classified and labeled" while nothing enforces from it. The 2024 Data Security Index prints that beside 88% who "believe they know where most of their critical information resides," under a heading explicitly calling it a disconnect between confidence and true protection; the 2025 documents name inconsistent classification and misclassification as live problems. So the material knows the attribute is unreliable and says so three times. What it never does is follow the failure downstream — no document traces a misclassification to the enforcement decision, alert or retention action that silently inherits it. The gap is in the consequence chain, not the acknowledgment. And the hedge works: "most" is exactly the fraction you cannot enforce against.

The cloud-DLP words: three architectures that fail differently#

Hold this dialect as three enforcement architectures. The corpus never compares them; the comparison is mine, and it is what an operator needs.

Protection bound to the content. A label — Public / General / Confidential / Highly Confidential, sold to employees as "your company's policy," which is a product default, my knowledge not theirs — travels with the object. Note how thinly it is claimed: the 2023 playbook asserts a Confidential label "will travel with the email and presentation wherever it goes," while the 2022 e-book puts the Word→Excel copy-paste case in the imperative — classifications "need to follow data as it travels." One asserts a capability, the earlier one states a wish, and neither gives it a boundary. Fails open, silently. Strip the label, convert the format, screenshot it, retype the numbers — protection is gone and no event fires. Per-object, gradual, and you find out never.

Policy enforced in the flow. DLP at endpoint, service and browser, including paste-blocking into AI apps. Both modes coexist: a hard block on copying a card-number spreadsheet to a flash drive, and "intelligent" DLP using context "to strike a balance," letting a user proceed after a reminder — a concession to the stated constraint that 74% of employees would bypass guidance to hit a business objective and 69% did last year. Fails at the channel boundary, loudly but incompletely. It covers enumerated egress paths only, so every new app is a fresh gap, invisible until someone enumerates it, and it is tuned against false-positive tolerance rather than coverage. Hence the operational picture: 66 alerts a day, 63% reviewed, 35% of those false positives.

Access gated at request time. RBAC, ABAC, least privilege, MFA — increasingly how the 2025 material frames protection. Fails closed, then wide. Normal failure is a denial: loud, self-correcting. Catastrophic failure is one over-broad standing grant or one stolen token, with no per-item attenuation — everything inside the grant goes at once.

That is the comparison the material owes you. The first two are per-object and degrade gradually; the third is per-principal and degrades catastrophically. They are not substitutes, and 2025's drift toward access framing is a change in the shape of residual risk, not an upgrade.

Across all three sits insider risk management: ML correlating behavioral signals against misuse of authorized access, with integration measured across People, Process, Tools and Training — the corpus's only measurement instrument, attached to no posture noun. Adaptive Protection, ML tuning the security/productivity balance to dynamically assessed user risk, is the best single idea in the control plane, because it makes control strength a function of the person rather than only the content. From outside the corpus: it is fed by insider-risk signals. The material never says so — it appears three times, all inside one retail e-book, never tied to insider risk — so the corpus never connects its two most distinctive capabilities.

Missing around it is employment law: works councils, jurisdictional limits on monitoring, notice, consent, appeal for a wrongly flagged employee. Three safeguards are named — role-based access, pseudonymized usernames by default, and audit logs, the last being the only one that could support review of a flag — and all three attach to communication compliance, not insider risk. In my experience that gap stalls European deployments. Communication compliance now also extends to Copilot prompts and responses, a categorical change rather than a scope increase: message scanning reads speech that already left the speaker, prompt scanning reads unsent formulation. The notice and works-council arguments that cleared the first do not automatically clear the second.

Posture is the central outcome noun, in five variants, and precision matters: one is scored — Compliance Manager assesses against pre-built regulatory assessments and returns a risk-based compliance score, which is control-to-regulation mapping and real. The other four carry no scoring method, and no posture variant is backed by a coverage-and-drift measure over the estate. (Zero Trust takes similar damage: "three pillars" in one chapter, "six key pillars of enterprise IT" two pages later, one noun for a strategy and for a coverage map.)

The commercial argument is tool sprawl as root cause: 202 incidents at organizations with 11+ tools against 139 for 10 or fewer. The 2024 passage dissolves itself on the page — it asserts "a strong correlation between the number of data security tools used and the frequency of data security incidents," then within two sentences prints the confound: 89 incidents on average at medium and large enterprises against 248 at extra-large, with tool counts of 9 / 11 / 14 by size. Size drives both, and the size spread is wider than the tool spread. The 2025 reuse keeps the claim and drops the confound. That both sat on one page is the more damning fact — and "data security incident," the unit counted, is defined nowhere.

The AI words#

The only genuinely new dialect, and thinner than its volume suggests. Genuinely new: prompts and responses as a governed data class, which breaks tooling built for files at rest and messages in flight; sanctioned versus unsanctioned AI apps, with the correct caveat stated outright that allowlisting is insufficient because sanctioned apps still need data-level policy inside them; AI output trustworthiness, widening the remit from inputs to outputs. Repackaged: shadow AI is shadow IT with a new object, described precisely — 65% admit unauthorized AI use — without the term ever appearing.

Oversharing is better defined than the shorthand suggests, and the definition is ammunition for your side. The 2025 financial-services e-book: "Data oversharing means sharing sensitive information or granting access to unintended recipients," with three named causes — misuse of collaboration tools, misclassified data, and inappropriate access permissions. The second is the classification-gate dependency stated out loud by the vendor. Only the permissions branch gets a control attached in the remedy; the misclassification branch is named as a cause and orphaned as a problem.

On the visibility complaint, the tidy renaming story is wrong: the nouns coexist from 2022 rather than succeeding each other ("blind spots" runs 2022, 2023 and 2024; "exposure gaps" 2023 and 2024). What changes is narrower and worse — dark data, the only one carrying a quantity and a stated cause (42% of organizations saying at least half their data is collected-but-unused), disappears after 2023, leaving the two unquantified nouns in service.

The consequential drift is AI itself. In 2022-23 it means the ML performing automated classification — machinery, not risk. The 2024 Index declares the collapse in its foreword ("the role and impact of generative AI (AI)") and then does something worse than adopting the new sense: it runs both senses simultaneously in adjacent sections with no marker — GenAI-as-risk-object on one page, "88% are already investing in AI to improve detection and response" on the next. You cannot tell from the word which pipeline is meant inside a single document. The 2025 IDC paper then re-separates GenAI from "traditional AI... around for decades." Nobody flags any of it.

The collision the material walks past#

The mechanism the corpus never states: an assistant indexing enterprise content inherits existing file permissions. A decade of over-permissioned SharePoint was safe by obscurity — nobody could find the compensation spreadsheet. Natural-language retrieval removes the obscurity. AI does not create the exposure; it removes the latency between exposure and discovery.

Now put that beside the moat. Label-bound protection is the portfolio's most differentiated idea, inherited from Rights Management — and labels bind to containers, while the AI surface is precisely where containers dissolve. An assistant reads twelve labeled documents and emits one paragraph of synthesized text with no container, no inherited protection, no provenance, and nothing for a policy engine to match on. The moat is strongest exactly where the new risk isn't. The corpus asserts coverage of the AI surface only through detection — communication compliance scanning prompts and responses — and never claims a generated response inherits a label, because no mechanism would make it so.

The open problem, stated your way: what label should a synthesized response carry when its sources disagree? Maximum of source labels, union of their policies, most restrictive? Who computes it at token-generation latency, when the retrieval set is known milliseconds before the first token? And what happens on the copy-paste out of the chat pane, where the container is created by the destination app? This is label propagation over a derivation graph — your problem, with a harder latency budget and a fan-in you do not control.

Words that changed meaning while keeping their spelling#

The last row needs its provenance: the binary formulation is a customer's, quoted verbatim by a hospitality CDTO on a page whose own framing is gap-and-readiness. It is not an incoherence — compliance against one clause is binary, posture across hundreds of controls is an aggregate — but a dashboard percentage is an aggregate, and it gets read as a control-level guarantee.

What is actually load-bearing#

The shape is not a stack. It is one gate with two dependents, plus one independent surface. Discovery and classification is the gate, and the silent input to everything above. Detection sits on it: an alert about "sensitive data moving" is meaningless without the attribute. Compliance evidence sits on it too, and is an assertion-and-provenance problem rather than a detection problem — control-to-regulation mapping and evidence production, which is metadata work.

Permissions are the fourth thing, and they are off-axis. Access gating does not consume classification; it is the parallel control plane above. Hence the tension worth sitting with: the AI exposure story runs entirely around the classification gate. The risk the vendor sells against — retrieval finding what permissions already allowed — is not gated by the capability you owned. Classification tells you a document is sensitive; it does not stop an assistant retrieving it for someone the ACL already admitted. Putting your corner on the critical path for AI risk means label-aware retrieval scoping, not better scanning.

The demand-side case is usually made with a number that does not survive its own standard: 87% of data security, governance, compliance and privacy leaders hold responsibilities across multiple areas. Apply the questions that sank 202/139 — who was surveyed, what counted as "responsibilities across," is a dotted line to privacy the same as combined ownership. The corpus answers none; the footnote reads "Microsoft, Customer Requirements Research, 2024," unpublished, with no n, sampling frame or instrument. It is less documented than the statistic it is meant to outrank, which at least publishes n=1,376, field dates and screening criteria. Demote it to illustration. The org-chart merger is almost certainly real and argues structurally instead: who the CISO's peers are, which VP carries the Purview P&L, whether compliance budget sits under Legal or Security, whether one person signs off on both a retention schedule and a DLP policy.

Here is the metric nobody computes, and the one thing on this list you could ship. Coverage and drift. An asset counts as covered when it carries a label, the label is newer than the asset's last write, an owner resolves to a live identity, and at least one enforcement policy names that label. Three of those are cheap; the freshness condition makes it honest, because it catches the mutated-after-labeling population. The denominator is the trap — the only one these tools have is assets the scanner already found, so coverage computed that way silently excludes exactly the population that matters. The honest denominators are external: subscription and billing inventory, resource-provider enumeration, endpoint inventory, reconciled against scan results, with the unreconciled remainder reported as a first-class number rather than dropped. Then the drift term — median age of labels on assets mutated since labeling. Decay rate, not coverage, separates a real program from a launch number.

Where the map ends#

Structured data is the absence that costs you most, because it is where your lineage graph already lives and where none of the label machinery reaches. The corpus claims coverage — one e-book says "whether it is structured or unstructured," a case study presents Microsoft Fabric as a secured platform — while naming not one structured-data control: no column- or row-level security, no masking, no tokenization. Same assertion-without-mechanism seam as classification, and the architectural reason is blunt: a label cannot attach to a row. Enforcement on structured data has to happen at query time inside each engine, and nothing in this portfolio sits at that point.

Three more, briefly. No AI threat model: the vocabulary stops at data poisoning, model tampering and integrity attacks, all asserted, none described; prompt injection, indirect injection through retrieved content, jailbreaks and membership inference are not named once. No key management: no BYOK/HYOK, HSM, rotation or confidential computing, under a "you own your data" commitment. No data subject rights, purpose limitation or breach clocks. And nobody raises consolidation's own risks; the single sentence touching portability, Apache Atlas APIs, is offered for open-source integration instead. The absence of the question is the finding, not the thinness of an answer.

The contradiction to carry is the one the corpus poses and drops. A Director of Engineering, Architecture and Analytics, 2024: "The security focus is about reducing the size of data... On the AI side, to make your models more representative to identify bias, you need more data. So how do you reconcile?" Unanswered, and the 2025 documents treat more data as unambiguously good without revisiting it. That middle clause makes it harder than minimize-versus-maximize: minimization is in tension with fairness. You cannot measure a model's bias across a protected subgroup you have minimized away.

Which is where your seven years stop being a corner. Provenance was a governance nicety when its consumer was a steward; it becomes an enforcement and evidence primitive the moment the consumer is a regulator asking what a model was trained on. The most valuable unbuilt thing here is closing the seam: catalog classification emitting enforceable labels, lineage carrying label propagation across derivations. It is unbuilt for four specific reasons, and you want them before anyone asks in an interview or a design review:

1. Latency. Scans are periodic and eventually consistent; enforcement decisions are synchronous and sub-millisecond. Nothing bridges that without a materialized, pre-pushed policy cache — a distributed systems problem, not a governance one.
2. Granularity. Labels attach to containers, catalog classifications to columns, and no representation survives the translation in either direction.
3. Enforcement-point ownership. The points that would enforce live inside query engines the governance product neither controls nor can block on.
4. No P&L owns the seam. It sits between two SKUs, so it is nobody's roadmap commitment — and that is the one that explains why the other three go unfixed.

Not a blindness story, and a better pitch than one: four tractable constraints, three of them your discipline.