Data lineage and the classification catalog

Overview

Govern → Data lineage answers three questions for the current environment:

Where did the data come from? A table in the data dictionary, a system an agent reached through the MCP gateway, a database an app read, or prompts and files people sent through a managed browser, the AI proxy, a coding agent or an app using the SDK.
Who used it? An agent, an app or service, a coding agent, or the people behind a managed browser or the AI proxy (counted, never named).
Where did it go? A model, an AI site or API, an MCP tool, or a person’s screen.

Each flow carries the data classes and kinds of sensitive data involved, how many events it covers, when it was first and last seen, and what the controls did: allowed, warned, masked or blocked.

The Classification catalog tab lists every data classification Shield360 knows, with its owner, its sensitivity, how it is handled and where it was seen.

What lineage is built from

Recorded by	Source	Used by	Sent to	Classification
Data gateway	The dictionary table read	The agent	`data.query` on the MCP gateway, or Try it	The dictionary’s classes of the fields asked for
MCP gateway	The MCP server, API, documents or contexts the tool belongs to	The agent	The tool	None; a result with sensitive values redacted counts as masked
Guards	The channel and what was checked: browser prompts or files, AI proxy prompts, coding-agent prompts, tool input or files, app requests	The coding agent or app; for browsers and the proxy, the people behind them	The model when recorded, otherwise the AI site or API	The kinds of sensitive data found, and the class each belongs to
Traces	A database a service read	The service	A model or a tool the service called	None
Dataset registry (declared)	A registered dataset	The AI system it is linked to	None	The dataset’s classes and kinds

Flows recorded by Dataset registry (declared) are what people declared, not what Shield360 observed: each registered dataset that is not retired becomes a source with a line to every AI system it trains, fine-tunes, evaluates, grounds or prompts. These lines are dashed, count no events and are shown whatever the period, until the dataset is retired. A flow’s detail says how the dataset feeds the system and which dictionary tables and lineage sources it corresponds to.

Data tools (data.describe, data.query) are read from the data gateway’s access records, not from the MCP gateway’s tool calls, so a governed read is counted once.

Kinds and classes

Each kind of sensitive data the guards find belongs to a data class of the data dictionary:

Class	Kinds
Secret	API key, private key, password, connection string, token, cloud credential
Personal (PII)	Social security number, email address, phone number, IP address
Financial	Payment card, IBAN

A kind no class names (a custom detector’s kind, for example) is shown as itself.

Explore the lineage

Choose a period

The last 7, 30 or 90 days. The API accepts any window of up to 92 days.

Filter

Narrow by Source, Used by, Sent to, Classification (a class, a kind, or Not classified) or Recorded by. Selecting a node in the graph filters by it.

Drill into a flow

Select a line in the graph to list the flows behind it, or switch to Table. Select a flow to see its classes, kinds with their event counts, outcomes, rows returned (data gateway), how many people (guards), and first and last seen.

Export

Export CSV or Export JSON downloads every flow the filters match, up to 5,000. Each export is recorded in the audit log with the window, the filters and the number of flows.

The graph shows the 12 busiest nodes of each column. The table and the export carry every flow; a report holds the 500 busiest flows and says when there were more.

Classification catalog

The catalog has one row for each data class of the data dictionary, each kind of sensitive data the guards know, and any other kind seen in the period. For each:

Column	What it shows
Owner	The person or team accountable for the classification. Free text.
Sensitivity	Public, internal, confidential or restricted. Until someone sets it, a class’s default applies (Customer is confidential; Personal, Financial and Secret are restricted) and a kind follows its class.
Handling	For a kind: what the browser extension, the AI proxy and coding agents do with it under this environment’s enforcement policy (off, warn, mask or block). For a class: the data gateway’s default (released, denied unless authorized, never released), how many dictionary columns carry it and how many authorizations release it clear or masked.
Seen	Events, consumers and destinations of the period’s lineage that involved it. Show in lineage opens the lineage filtered to it.

Owners, sensitivity and descriptions belong to the organisation: every environment shows the same entries. Handling and Seen are the current environment’s. Handling is changed in the enforcement policy, not in the catalog.

Changing an entry needs the Manage the data dictionary permission from the organisation role (a project role does not grant it). Each change is recorded in the audit log with the classification and the names of the fields changed.

Controls and evidence

The check Data flows to AI are traced, and every sensitive classification seen has an owner (data.lineage) on Controls:

is not applicable while no flow through the data gateway, the MCP gateway or the guards was recorded in the period;
is a gap while any classification more sensitive than internal was seen in those flows without an owner in the catalog;
is met otherwise, with the flows, classifications, and blocked and masked events counted.

It backs ISO/IEC 42001 A.7.2 (data for AI systems) and A.7.5 (data provenance), EU AI Act Art. 10 (data and data governance), and NIST AI RMF MEASURE-2.10 (privacy risk is examined).

The dataset registry adds its own check, datasets.governed, for the data assets that train, evaluate or ground AI systems. The lineage check counts observed flows only.

Evidence packages include data-lineage-summary.json: the period’s flows counted by classification, outcome and origin, and the sensitive classifications seen without an owner. No source, consumer, destination, person or value is named.

Access

Action	Permission
See the lineage and the catalog	View data protection events
Export the lineage	Export data protection evidence
Change catalog owners, sensitivity and descriptions	Manage the data dictionary (organisation role)

Administrators and Compliance officers have all three.

API

# The lineage of the last 30 days, flows that carried email addresses
curl -H "Authorization: Bearer <api key>" \
  "https://<your-shield360>/api/data-gateway/lineage?period=30d&classification=email"

# Every flow as CSV
curl -H "Authorization: Bearer <api key>" -o lineage.csv \
  "https://<your-shield360>/api/data-gateway/lineage/export?format=csv&period=30d"

# The classification catalog, and setting one entry's owner
curl -H "Authorization: Bearer <api key>" "https://<your-shield360>/api/data-gateway/classifications?period=30d"
curl -X PUT -H "Authorization: Bearer <api key>" -H "Content-Type: application/json" \
  -d '{"key": "pii", "owner": "Privacy office", "sensitivity": "restricted"}' \
  "https://<your-shield360>/api/data-gateway/classifications"

Filters are source, consumer and destination (a node as type:name, for example agent:Support bot or registered_dataset:Support tickets 2025), classification and origin (data_gateway, mcp_gateway, guard, traces, registry). The window is period (7d to 92d) or from and to.

Limits

Lineage covers only the paths Shield360 observes. Data that reaches a model, a tool or a person any other way (a direct API call outside the proxy, a browser without the extension, an app without the SDK or traces) is not shown.
Guard decisions record what was checked, not the file or record it came from: their source is the channel (browser prompts, coding-agent files), not a named file or repository.
MCP gateway calls and traces carry no classification. A flow marked Not classified was not checked for sensitive data by a guard; it is not a statement that it held none.
Traces link a service to the databases it read and the models and tools it called, not one request’s database read to the same request’s model call.
Browser interaction records (every prompt, whatever the guard decided) are not yet part of lineage; browser flows come from guard decisions.
Lineage reads the period’s records each time; a period longer than a source’s retention shows what is still kept.

Next steps

Data gateway

Classify tables and govern which agent may read which data.

Dataset registry

Controls

See the lineage check alongside the rest of the evidence.