Information-flow control is the set of rules and technical mechanisms that limit where data can move and who can see it. It goes beyond simple access control: a system may be allowed to read data, but not to copy, transform, or publish it to a broader audience. Common controls include data labeling, authorization checks, output filtering, logging, and “need-to-know” restrictions.
In cyber security, information-flow control helps prevent accidental leaks, insider misuse, and privilege escalation through software integrations. It is especially important in AI-assisted workflows, where a model or agent may summarize a private message, post a response, or route content into another system. Defenders use separate approval gates for reading and publishing, enforce least privilege, and monitor cross-domain transfers so sensitive data cannot escape its intended boundary. When these controls are missing, a trusted tool can become a distribution channel for data that should have stayed contained.