Day 48: License and Training-Data Risk

Training on the wrong corpus is a legal and trust problem, not an ML flex. Treat dataset intake like dependency licensing. Day 48 enforces manifests, secret scans, and counsel-approved sources.

⚡ TL;DR: Allowlist sources with license/ToS/PII fields. Block ToS-forbidden scrapes and unauthorized customer data. Fail CI without approved_by. Keep a purge path.

source: internal-sdk-git
license: proprietary-internal
tos_ok: true
pii_risk: low
customer_data: false
approved_by: legal-2026-08-01

❌ "It's on GitHub so we can train"

Typical hard nos (confirm with counsel): sites that ban ML training in ToS; customer repos without contractual rights; secrets in samples; copyleft into proprietary weights without review. Citation-friendly RAG (Day 26) also reduces “invented copyrighted docs” product risk.

Production checklist

• [ ] Dataset manifest with legal fields
• [ ] Automated secret scan
• [ ] Customer-data path reviewed
• [ ] Counsel contact on runbook
• [ ] Purge procedure tested
• [ ] Training job refuses unsigned manifests

Series navigation

← Day 47 · Day 49 →

Last updated September 11, 2026