Audit-ready governance for AI doxing risk