Preventing Personal Record Exfiltration Across Application Interfaces and Language Model Tools under 152-FZ
Connecting a language model or external service interface to a customer database creates a severe risk of leaking names, phone numbers, and emails into third-party logs. The verifier detects personal record leakage channels without ever storing raw customer files on disk and compiles an outbound redaction contract.
Federal Law No. 152-FZ dated July 27, 2006 (Article 19) and Order No. 21 of the Federal Service for Technical and Export Control of Russia dated February 18, 2013 establish strict organizational and technical measures for personal data information systems across security levels UZ1 through UZ4. When enterprises attach conversational assistants, search indexes, or model context protocol tools to customer tables, new cross-tenant and outbound exfiltration paths appear.
Security Officer (Plain Meaning): Halts "Store unmasked personal data in scanner logs or transmit customer records to external model provider" before socket (0 live DB damage, signed GOST receipt)
IT Auditor & SecOps (Evidence): Scope 152-FZ / FSTEC Order 21 / UZ1-UZ4 | Wire Rule SEC-ZD-CMP-03 | Formal Witness 93b4c618e20f5d47
Technocrat, CTO & VC (Moat): Z3 Invariant (assert (forall ((resp Payload)) (=> (contains_personal_da... | FP = 0.0% | Contract IMMUNE-CMP-93B4C618 (mcp-sentinel 1.1.2)1. Regulatory Enforcement and Verification Schematic for CMP-PDN-03
Deterministic compliance verification flow for CMP-PDN-03 (152-FZ / FSTEC Order 21 / UZ1-UZ4, OWASP LLM02 / ASI01 Data Exfiltration): wire rule SEC-ZD-CMP-03 intercepts destructive mutations prior to socket transmission, witness 93b4c618e20f5d47 seals the empirical proof, and compiler emits gateway contract IMMUNE-CMP-93B4C618 for mcp-sentinel.
2. Regulatory Mandate, Safe Execution, and Solver Invariant for CMP-PDN-03
A major compliance failure of legacy vulnerability scanners is that they save raw server responses containing leaked personal records directly into unencrypted scan reports. Under rule SEC-ZD-CMP-03, the verifier operates on synthetic watermarked fixtures and hashes any detected personal record structure in process memory before writing to disk.
The audit engine tests four privacy boundaries: explicit consent verification on intake forms, cross-tenant object isolation, retrieval index filtering, and outbound tool-call redaction. Comparing vulnerable routes against compliant decoys produces formal witness 93b4c618e20f5d47 with zero false positives.
Section Identifier: CMP-PDN-03 (fz_152_pdn_agent_leakage)
Standard & Profile: 152-FZ / FSTEC Order 21 / UZ1-UZ4 | OWASP LLM02 / ASI01 Data Exfiltration
Verification Mode: Deterministic Verification (AUTO_SCAN)
Candidate Probe: POST /api/v1/compliance/pdn-152 {"law":"152-FZ_Art19","order":"FSTEC_21_UZ1","probe":"mcp_tool_read_customer_profile -> outbound_webhook"}
Prevented Harm: Store unmasked personal data in scanner logs or transmit customer records to external model provider
Z3 Solver Invariant: (assert (forall ((resp Payload)) (=> (contains_personal_data_pattern resp) (and (redacted_before_log resp) (consent_verified resp) (external_egress_blocked resp)))))
Wire Verification Rule: SEC-ZD-CMP-03
Formal Witness Hash: 93b4c618e20f5d47
Compiled Sentinel Rule: IMMUNE-CMP-93B4C618 (mcp-sentinel 1.1.2)3. Cryptographic Acceptance Evidence for IMMUNE-CMP-93B4C618 and Streebog-256 Receipt
From witness 93b4c618e20f5d47, the compiler emits contract IMMUNE-CMP-93B4C618 for the mcp-sentinel gateway. The contract blocks unconsented intake requests, strips personal identifiers from outbound tool arguments, and prevents unauthorized cross-border transmission.
4. Auditor and Inspector Reference Notes for CMP-PDN-03
Why the verifier never becomes an unauthorized store of personal records
All probes run against synthetic canary records, and any sensitive pattern encountered in a response is immediately replaced by an irreversible salted hash before logging.
Enforcing Article 9 consent requirements at the application gateway
The compiled gateway rule rejects any form submission that lacks an explicit boolean consent flag and a verified link to the active consent document version.