TN: Data Governance That Travels Through SQL, Dataframe, and LLM Pipelines

This work has been submitted to the IEEE for possible publication. Copyright may be transferred without notice, after which this version may no longer be accessible. Data governance (access rules, purpose limits, obligations, and claims about what data means) is enforced where data is stored and served, but derived data rarely inherits it. Query results, aggregates, and reports written by large language models (LLMs) leave the system that governed their inputs, and downstream consumers cannot tell which rules still bind them. TN represents a value together with its source policies. A calculation on governed inputs produces another governed value carrying their policies. Signed claims retain their original authors and subjects. Each receiving endpoint verifies the policies bound to the result and decides the proposed use under its own authorities and keys. An analyst joins two tables to prepare a financial report. The query filters on companies.active and returns the selected amounts. Although the active flag is absent from the result, those amounts carry the internal-use policy on companies. A dataframe aggregate computed from them inherits that policy. When an application supplies a governed value to an inference server, the server puts its policies and claims in the model's prompt before the model can request a protected field. Immediately before generation, the runtime checks that the scheduled input tokens and settings match the task it authorized. TN is a wire protocol for exchanging governed values between applications. Its adapters let developers use ordinary SQL queries, Polars expressions, Python operators, and calls to an inference server. As long as the application passes governed values through these interfaces, the adapters package each result with its policies and claims automatically. In our evaluation, Qwen3-4B generated an HTML report from data queried in SQL, aggregated in Polars, and formatted in Python. The report retained the source policies and original claims.