Governance

What may and may not be sent to a model, which vendors and models are approved for which data classes, retention and training terms, and who to ask when a case is not covered.

This is the page people cite in an incident, so keep it unambiguous and keep it current. Where a rule comes from legal, security or a vendor contract, link the source and note when it was last confirmed.

Say plainly when something is undecided rather than leaving a gap that reads as permission.