Why Enterprise AI in ChatGPT, Claude and Every Corporate AI Deployment Needs Cryptographic Limits on Joining Company Data

Technical Non-Joinability and Output-Release Control for Enterprise AI, with 79 Implementation and Functional Profiles Description: Companies are connecting AI assistants and agents to their email, files, code, customer records, finance systems and supplier data. Examples include business deployments of OpenAI’s ChatGPT and Anthropic’s Claude, as well as Microsoft Copilot, Google Gemini Enterprise, Amazon Q Business, Salesforce Agentforce and ServiceNow AI Agents. Each connection is usually authorised on its own. The danger is what happens when they are combined. An AI that may read customer complaints, engineering tickets, code commits, supplier orders, hiring plans and budgets can join those fragments into something no single system ever stored: an accurate picture of what the company is about to do next. If that AI workload is compromised, misled by instructions hidden in a document, or simply over-connected, years of carefully separated security can collapse into one unrestricted view. That view can then be shown, saved, sent or acted on. Today this risk is managed mostly by access rules, contracts, filters and policy promises. These are necessary, but they do not technically stop an AI that can read A and B from joining A with B. This gap is a major reason why many enterprises, especially in banking, defence, healthcare and government, still hesitate to give AI deep access to their data, and why companies hesitate to share data with each other through AI. This publication describes a vendor-neutral architecture that closes the gap with technical, verifiable limits. Identity data, business content and the information that links them are kept under separately controlled protection domains. Permission to read pieces is separated from permission to join them. Only the exact relationships approved for a task, session and purpose are rebuilt, inside a protected environment, as a temporary minimum view, and the AI never receives master keys to the underlying data. After the AI finishes, its answer or proposed action stays sealed. Current conditions are checked again and tamper-evident evidence is written. Only then is a single-use release permission created for that exact result and destination and checked at the real exit point. If anything is uncertain, nothing leaves. The work is organised as 79 Implementation and Functional Profiles. They cover multi-vault separation, independent authority to join data, session-bound reconstruction, prevention of permanent combined views in memory, streaming output control, agent tool calls, runtime behaviour checks, provenance through multi-agent and MCP tool chains, protection against prompt injection, fail-closed policy distribution and multi-party approval for high-risk release. The PDF includes: a plain-language explanation; a section on where the problem sits for enterprise deployments of Claude and ChatGPT, with thirteen generic risk patterns (such as union-of-permissions joins, prompt injection, leaks through tools, memory that becomes a permanent join, and policy-outage fallback) mapped to the profiles that address them; suggestions for how AI providers could earn enterprise trust more securely; the full technical specification with pseudocode, invariants, and an attack-and-failure table; references to a runnable reference implementation reporting 16 passing automated tests. That implementation is an architectural demonstration, not a production security certification. The industry relevance and risk-pattern sections are AI-generated and are not an endorsement. No named company has reviewed, approved or is affiliated with this work. Nothing here claims that any product uses, lacks, infringes or is vulnerable to the described methods, and the risk patterns are generic rather than findings about any product. Readers are strongly advised to read the original PCT filings and each provider’s own current documentation before drawing any conclusion. This publication is based on the Mothership application PCT/IB2026/055615, filed 4 June 2026 and publicly disclosed 16 July 2026, which claims priority from PCT/IB2026/053385, filed April 2026 and publicly disclosed 4 June 2026. The author is open to strategic collaboration, licensing or acquihire discussions. Keywords: enterprise AI security; ChatGPT Enterprise; Claude Enterprise; AI data aggregation; mosaic effect; technical non-joinability; access versus association; multi-vault architecture; least privilege; data minimisation; purpose limitation; confidential computing; prompt injection; data exfiltration; AI agents; Model Context Protocol (MCP); AI memory; output release control; sealed output; single-use capability; fail-closed; data provenance; cross-organisation trust; EU AI Act; GDPR. License: CC BY-NC 4.0