When Copilot Can See Too Much: Why AI Security Starts with Data Governance