The group finance director supplies the newest company's nominal ledger and the group's chart-of-accounts mapping as files, and asks the AI model to map one to the other and draft integration notes on the cost lines that do not fit. The cost lines reach the model as they are; customer names, which are marked, reach it as placeholders. A manager not cleared for the customer-name column who asks for it is refused, and the refusal is recorded.
Fields you mark sensitive reach the AI model masked with placeholders; fields you don't mark reach it as they are. The same value always gets the same placeholder, so masked data can still be linked to a person and remains personal data.
On records loaded into Kovac, someone not cleared for a column you have marked who asks for it is refused, and the refusal is recorded.
Clearance decides what a person may read. It never unmasks a field for the AI model: a marked field reaches the model masked on every call, whoever asks.