The sandbox is not the boundary

Ask a fintech or healthcare data science team where their sensitive data is protected and they will point at the sandbox: de-identified records, a locked-down notebook environment, access requests that go through a review. That part is usually done well. The part that quietly isn't is what happens next.

Promotion is where the real boundary sits

A model that performed well in the sandbox eventually needs real data to be useful — real transaction histories, real clinical records. The moment that happens, the sandbox stops being the control that matters. What matters is whether moving a model from staging into that real-data environment is a reviewed, logged, gated event, or just a deploy anyone with the right credentials can run on a Friday afternoon.

In most stacks we have seen, it is the latter. The sandbox gets the compliance attention because it is the visible part. The promotion path gets none, because it looks like ordinary infrastructure work.

A gate has to be able to say no

A promotion gate that can be skipped under time pressure is not a gate, it is a suggestion. The useful version blocks automatically on a failed check — a leakage scan, a fairness test, a latency threshold — and requires a recorded override to bypass, not a config flag nobody remembers exists.

Lineage answers the question before it is asked

When an examiner or an auditor asks which data trained a production model, the answer should already be written down against that model version, not reconstructed from Slack threads and a training script somebody half-remembers running. The record has to be a byproduct of the pipeline, not a task someone does afterward.