Data governance is the most relevant corporate policy because input filtering depends on knowing what information may enter the AI system, how that information is classified, and which categories of sensitive or regulated data must be blocked, redacted, masked, or otherwise controlled. CompTIA SecAI+ specifically includes sensitive data governance under corporate AI policies and separately identifies data classification labels, redaction, masking, minimization, and related data-safety controls. A security architect can therefore translate the organization ' s data governance rules into technical input-filtering requirements, such as preventing credentials, customer PII, financial information, confidential intellectual property, or restricted datasets from being submitted to a model. A public-model usage policy governs whether and how employees may use externally hosted models, but it is narrower than the underlying data-handling rules. Third-party compliance evaluates external providers and contractual or regulatory obligations. Terms of use describe permitted user behavior but normally do not provide the detailed data-classification requirements required to implement technical filtering. Data governance is therefore the authoritative basis for determining what input the AI system should accept or reject.

================