PCI DSS 4.0 data governance framework for enterprise LLM deployment — Reference Architecture

Reference architecture · published 2026-10-16 · regulated enterprise · PCI DSS 4.0 · layout control_review · implementation executed in CI before publish

The control that resolves this is a Classification-Routed Multi-Cloud Estate, evaluated before the request reaches a model provider rather than audited afterwards. In regulated enterprise the binding constraint is PCI DSS 4.0, and the question it actually asks is is cardholder data in scope, and can you prove it is not. The shape below holds p95 ≤ 600ms over REST over HTTPS, and ships with a standard-library implementation that runs as written.

Where the rollout actually stalls

Workloads span several providers and regions, and the decision of which model may see which data lives in prompt text, a wiki page, or a developer's judgement. That is not a control, so the governance board cannot approve the estate even though every individual component is defensible.

What PCI DSS 4.0 specifically requires

PCI scope is contagious: any system that stores, processes or transmits cardholder data — or can affect the security of one that does — is in scope. The cheapest control is to keep the model tier out of scope entirely.

The artifact that satisfies it is a segmentation test proving the model tier is out of scope. The way teams most often fail it: a PAN reaching a prompt log, dragging the whole inference tier into PCI scope.

Controls and acceptance parameters

Each row carries an acceptance parameter rather than an adjective, because "low latency" cannot be signed off. Retention here is bound by per the data class retention schedule, enforced automatically.

Implementation parameter matrix

Every value below is a parameter you can hold a vendor or an internal team to. Adjectives are not acceptance criteria.

What the auditor will ask

• Is the inference tier in PCI scope, and what segmentation test proves it is not?
  Cardholder data is tokenised before the model boundary and the segmentation is evidenced by an annual penetration test, so the tier stays out of scope by design.
• What function decides which destination may see RESTRICTED data, and where does it run?
  The routing gate, evaluated before egress. It is a deterministic function of the data's classification and the destination's attested properties, and it fails closed when no destination is lawful.
• Show me the recorded reason for a denial last week.
  Every allow and every deny is written to the decision log with the reason — which destinations were rejected and on which property — so a denial is explainable months later.
• When a document is embedded, does the embedding carry its classification — and is that enforced on read?
  Yes. The classification tag propagates into every derived store, including embeddings, caches and eval sets, and is enforced on read as well as write.
• What happens when a provider adds a subprocessor you have not disclosed?
  The drift detector alerts when a destination's attested properties change, and routing is re-evaluated against the new attestation. Attestations are versioned data, not a one-off questionnaire.
• How do you prove processing stayed in the contracted region?
  The provider endpoint is pinned per region and the served region is asserted on the response; a mismatch fails the request rather than completing it quietly.

The blueprint

Classification-Routed Multi-Cloud Estate — the request path, with the decision points that must exist before the first model call:

flowchart TB
    IN[Request payload] --> CLS[Deterministic classifier<br/>regex + Luhn/checksum]
    CLS --> LV{Classification}
    LV -->|PUBLIC / INTERNAL| D1[shared-us]
    LV -->|CONFIDENTIAL| D2[eu-pooled<br/>DPA required]
    LV -->|RESTRICTED| D3[eu-dedicated<br/>zero-retention + subprocessors]
    LV -->|no lawful destination| DN[Deny + reason]
    D1 --> LOG[(Decision log)]
    D2 --> LOG
    D3 --> LOG
    DN --> LOG
    D3 --> LIN[Lineage tag on<br/>embeddings / cache / evals]
    ATT[Destination attestations] -.-> LV
    ATT --> DR[Drift detector]

Component breakdown

1. Deterministic classifier — Pattern plus validator (Luhn, checksum) so the gate does not cry wolf.
2. Destination attestations — Region, max class, retention, DPA, subprocessor disclosure — as data.
3. Routing gate — First lawful destination in preference order; cost can never override a control.
4. Decision log — A recorded reason for every allow AND every deny.
5. Lineage tags — Classification travels with derived artifacts: embeddings, caches, evals.
6. Drift detector — Alerts when a destination's attested properties change.

Implementation artifact — Classification-driven routing gate with recorded reasons

Standard-library Python, no external dependencies, runs as written. Executed by the publish gate: if it raises, this page does not ship. Wire it behind REST over HTTPS; the failure mode it guards against is a retried POST creating a duplicate record. The output you hand the assessor is the segmentation test report.

"""Classification-driven routing gate for a multi-cloud LLM estate.

Why this shape: "which model may see this data" is a governance decision, and
if it lives in prompt text or a developer's judgement it is not a control. It
has to be a deterministic function of the data's classification and the
destination's attested properties, evaluated before egress.

The gate below is the smallest thing that an actual data-governance board will
accept: classification in, allowed destinations out, with a recorded reason for
every allow and every deny.
"""
import re
from dataclasses import dataclass
from enum import IntEnum


class Class(IntEnum):
    PUBLIC = 0
    INTERNAL = 1
    CONFIDENTIAL = 2
    RESTRICTED = 3      # PII / PHI / material non-public


DETECTORS = {
    "email": re.compile(r"[\w.+-]+@[\w-]+\.[\w.]{2,}"),
    "iban": re.compile(r"\b[A-Z]{2}\d{2}[A-Z0-9]{10,30}\b"),
    "card": re.compile(r"\b(?:\d[ -]?){13,19}\b"),
    "ssn": re.compile(r"\b\d{3}-\d{2}-\d{4}\b"),
    "mrn": re.compile(r"\bMRN[:\s-]*\d{6,10}\b", re.I),
}


def luhn(number: str) -> bool:
    """Card detectors without Luhn produce false positives on order numbers,
    and a gate that cries wolf gets switched off."""
    digits = [int(c) for c in re.sub(r"\D", "", number)]
    if len(digits) < 13:
        return False
    checksum, parity = 0, len(digits) % 2
    for i, d in enumerate(digits):
        if i % 2 == parity:
            d *= 2
            if d > 9:
                d -= 9
        checksum += d
    return checksum % 10 == 0


def classify(text: str, floor: Class = Class.INTERNAL) -> tuple:
    """-> (classification, evidence). Deterministic and explainable."""
    found = []
    for name, rx in DETECTORS.items():
        for m in rx.finditer(text or ""):
            if name == "card" and not luhn(m.group(0)):
                continue
            found.append(name)
            break
    return (Class.RESTRICTED if found else floor), sorted(set(found))


@dataclass(frozen=True)
class Destination:
    name: str
    region: str
    max_class: Class
    zero_retention: bool
    dpa_signed: bool
    subprocessors_disclosed: bool


class Denied(Exception):
    pass


def route(text: str, destinations: list, required_region: str = None) -> dict:
    """Pick the first destination whose ATTESTED properties cover the data.

    Order matters: destinations are supplied in preference order (cheapest or
    fastest first) and the gate takes the first one that is lawful, so cost
    optimisation can never override a control.
    """
    level, evidence = classify(text)
    reasons = []
    for d in destinations:
        if d.max_class < level:
            reasons.append(f"{d.name}: max_class {d.max_class.name} < {level.name}")
            continue
        if required_region and d.region != required_region:
            reasons.append(f"{d.name}: region {d.region} != {required_region}")
            continue
        if level >= Class.RESTRICTED and not d.zero_retention:
            reasons.append(f"{d.name}: retains prompts, unusable for {level.name}")
            continue
        if level >= Class.CONFIDENTIAL and not d.dpa_signed:
            reasons.append(f"{d.name}: no DPA on file")
            continue
        if level >= Class.RESTRICTED and not d.subprocessors_disclosed:
            reasons.append(f"{d.name}: subprocessors undisclosed")
            continue
        return {"allowed": True, "destination": d.name,
                "classification": level.name, "evidence": evidence,
                "rejected": reasons}
    raise Denied(f"no lawful destination for {level.name} data: {reasons}")


if __name__ == "__main__":
    dests = [
        Destination("shared-us", "us-east-1", Class.INTERNAL, False, True, False),
        Destination("eu-pooled", "eu-west-1", Class.CONFIDENTIAL, False, True, True),
        Destination("eu-dedicated", "eu-west-1", Class.RESTRICTED, True, True, True),
    ]
    print(route("Summarise this quarter's churn drivers.", dests))
    print(route("Patient MRN 4471902 reports side effects.", dests,
                required_region="eu-west-1"))
    try:
        route("Card 4111111111111111 was declined.",
              [d for d in dests if not d.zero_retention])
    except Denied as e:
        print("correctly denied:", str(e)[:96])

The PCI DSS 4.0 control, as code

PAN tokenisation and a scope-reduction proof. This is the artifact an assessor asks for under PCI DSS 4.0 specifically — it is not the same control as the one above, and a system that implements one does not thereby implement the other. It executes under the same publish gate.

"""PAN detection with tokenisation, and a scope-reduction proof.

PCI DSS 4.0 scope is everything that stores, processes or transmits account
data, plus anything connected to it. The cheapest compliance move is not better
controls — it is removing systems from scope. A model gateway that never sees a
PAN is out of scope; one that sees it once is in, along with everything it talks
to.
"""
import hashlib
import re

PAN_RE = re.compile(r"\b(?:\d[ -]?){12,18}\d\b")


def luhn_valid(digits: str) -> bool:
    total, parity = 0, len(digits) % 2
    for i, ch in enumerate(digits):
        d = int(ch)
        if i % 2 == parity:
            d *= 2
            if d > 9:
                d -= 9
        total += d
    return total % 10 == 0


class TokenVault:
    """Format-preserving surrogate. The vault is in scope; nothing it feeds is,
    provided the surrogate is not reversible outside it."""

    def __init__(self, pepper: str):
        self._pepper = pepper
        self._map: dict[str, str] = {}

    def tokenise(self, pan: str) -> str:
        digest = hashlib.sha256(f"{self._pepper}:{pan}".encode()).hexdigest()
        surrogate = "4" + str(int(digest[:15], 16)).zfill(15)[:15]
        self._map[surrogate] = pan
        return surrogate

    def last_four(self, pan: str) -> str:
        return pan[-4:]


class ScopeBoundary:
    def __init__(self):
        self.systems: dict[str, bool] = {}
        self.flows: list[tuple[str, str]] = []

    def add(self, system: str, sees_pan: bool) -> None:
        self.systems[system] = sees_pan

    def flow(self, src: str, dst: str) -> None:
        self.flows.append((src, dst))

    def in_scope(self) -> set[str]:
        scope = {s for s, sees in self.systems.items() if sees}
        changed = True
        while changed:                      # connected-to is also in scope
            changed = False
            for src, dst in self.flows:
                if src in scope and dst not in scope:
                    scope.add(dst); changed = True
                elif dst in scope and src not in scope:
                    scope.add(src); changed = True
        return scope


def redact(text: str, vault: TokenVault) -> tuple[str, int]:
    found = 0
    def _sub(m):
        nonlocal found
        raw = re.sub(r"[ -]", "", m.group(0))
        if not luhn_valid(raw):
            return m.group(0)
        found += 1
        return f"tok_{vault.tokenise(raw)}(last4={vault.last_four(raw)})"
    return PAN_RE.sub(_sub, text), found


if __name__ == "__main__":
    vault = TokenVault(pepper="hsm-managed")
    text = "Charge card 4111 1111 1111 1111 for invoice 9912, ref 1234567890123456"
    out, n = redact(text, vault)
    assert n >= 1 and "4111 1111 1111 1111" not in out, out
    assert "last4=1111" in out, out

    # A number that fails Luhn is not a PAN and must not be mangled.
    benign, n2 = redact("order 1234 5678 9012 3450 placed", vault)
    assert n2 == 0 and "1234 5678 9012 3450" in benign, benign

    sb = ScopeBoundary()
    sb.add("checkout", True); sb.add("token_vault", True)
    sb.add("llm_gateway", False); sb.add("analytics", False)
    sb.flow("checkout", "token_vault"); sb.flow("token_vault", "llm_gateway")
    scope = sb.in_scope()
    assert "llm_gateway" in scope, "connected-to is in scope — that is the point"

    clean = ScopeBoundary()
    clean.add("checkout", True); clean.add("token_vault", True)
    clean.add("llm_gateway", False)
    clean.flow("checkout", "token_vault")
    assert "llm_gateway" not in clean.in_scope(), clean.in_scope()

    print("PCI DSS 4.0 tokenisation + scope reduction: OK")
    print(f"  PANs tokenised {n}, naive scope {len(scope)} systems, "
          f"segmented scope {len(clean.in_scope())} systems")

Adjacent problems

• Part of enterprise ai data governance.
• For the related constraint, see EU AI Act data governance framework for enterprise LLM deployment.
• This pattern also governs SOC 2 Type II data governance framework for enterprise LLM deployment.
• GDPR data governance framework for enterprise LLM deployment covers the adjacent case.
• Where this interacts with another regime, see fedRAMP Moderate data governance framework for enterprise LLM deployment.
• If this is the blocker in front of you: enterprise AI infrastructure review.