Establish sandbox ingestion paths
- Ingest multi-format files into an isolated S3 account with Lake Formation governance to prevent accidental exposure.
- Attach automated PII scrubbing using Amazon Comprehend, Rekognition, or custom detectors before data leaves the quarantine zone.
- Version every extract with Git-friendly manifests so experiments can be reproduced as hypotheses evolve.
