SoK: Sticky Policies Come Unstuck: Where Data-Governance Claims End at Generative Handoffs

Modern applications move data through databases, APIs, observability pipelines, and generative systems; each hop can create a new data object: a stored derivative, an agent's tool result, per-step logs. Each component may correctly enforce its controls while the end-to-end path loses the governance basis for new outputs. LLMs both ease and complicate this crossing: they interpret ordinary-language claims without the sender's executable policy grammar, yet create content probabilistically and may release it. We characterize data-governance preservation as an architectural property of generative paths under a declared scope and trust model. At each in-scope use or release, the responsible mechanism must identify the exact output's applicable claims, join them with current request authority, and mediate every declared path. After content-changing derivation, authorized transition semantics must establish the output's governance basis and make it obtainable or resolvable downstream. We formalize this as a decision-factorization condition: correctness is possible exactly when every trusted-state equivalence class retains a common permitted decision; no universal policy language is required. We evaluate sixteen mechanism families across six lifecycle stages and four cross-stage interfaces, and we adjudicate eight product- and protocol-specific boundary paths selected as the strongest public candidates for demonstrating full continuation. Every stage has a released stage-local witness. Yet no inspected released path gives an independently governed receiver an authenticated, inspectable account of upstream governance across a content-changing derivation. Relative to each path's declared scope, six of the eight first become unsupported at derivation to handoff, two at semantics to enforcement. Positive controls confirm the method credits paths that compose. Natural language reduces policy-syntax interoperability costs but does not authenticate the claimant, bind a claim to the exact output, or prove enforcement.