Ensuring grounded data only ever includes what the requesting person or system is authorised to see, in a form that respects field-level sensitivity, and never leaves an environment it isn't permitted to leave. Normalises heterogeneous per-system permission and residency models into one enforcement point applied before generation, not after.