[ITmedia Enterprise] Toda Construction opens its data infrastructure to all employees, “half a step ahead” of governance and risk assessment using AI

The foundation is a data warehouse (DWH) called ``Snowflake'' that uses primeNumber's data linkage service ``TROCCO'' to import internal and external data. The BI tool "Tableau" is used for visualization, and primeNumber's "COMETA" is used for data cataloging. Previously, CSV files were extracted from each system and aggregated manually, but now users can check the numbers themselves on Tableau or link the data collected on the platform to business applications.

Rather than building a large infrastructure from the beginning, we increased the amount of data we were importing in response to the needs of the field. The number of source systems that were imported from 10 at the time of release had increased to 20 at the time of the presentation, and the number of tables from 94 had increased to approximately 1,600.

The architectural planning department first started using it. This was because there was a clear challenge: to compare personnel allocation with sales projects and decide whether or not to accept an order. After seeing how the department had streamlined decision-making with dashboards, the Data Management Division of the Corporate Planning Office joined the team. The members of the division originally had high analytical skills as analysts, but they were having difficulty collecting data.

As the number of users increases, the administrative burden also increases. This is because as the number of users increases, the question becomes ``to whom can I see how much?'' Mr. Isshiki summarized the changes over the past two years into three points: expanded utilization, improved governance and organization, and data protection and development using AI.

Role sharing between those who expand utilization and those who support the foundation

It was the data management section of the corporate planning office that expanded its use within the company. Once the infrastructure made it easier to collect data, the division listened to requests from each department about what kind of data they wanted to see, and turned it into a dashboard. As the department worked like an evangelist to spread the use of the platform, various departments began to want to use the platform.

During that time, Isshiki and his colleagues concentrated on operating the infrastructure. Its role is to ensure the stable operation of the data pipeline created by Snowflake and TROCCO, and to establish rules and guardrails that users can use with peace of mind. What would have happened if the infrastructure side had been responsible for promoting utilization? Looking back, Isshiki says, ``There was definitely a lack of resources.'' ``It turned out to be a good thing that we were able to separate the roles of those who spread the information and those who protect it,'' he said.

This division of labor was also reflected in the organization. In March 2026, the Infrastructure Security Department was renamed the Digital Platform Department, and a new Data Management Department was established within the department. "Two years ago, we didn't have an organization yet, so we just called ourselves the 'Data Management Team.' The fact that it was recognized as a department is our biggest accomplishment over the past two years," Isshiki says.

This division will be responsible for infrastructure maintenance and operation, data management, and company-wide governance. The Corporate Planning Office also has a section with the same name, but that is the department that promotes the use of the system. Mr. Isshiki explains that the Corporate Planning Office is positioned to play an ``offensive'' role, while the Digital Platform Department is positioned to play a ``defensive'' role.

Rules and support to keep pace with usage growth

The way we set up governance also changed depending on the stage of use. For a while after full-scale operation began in June 2024, users were limited to architecture and civil engineering planning departments, and the corporate planning department that joined later. All of these departments handle data similar to management, and have the ability to read data. Since there was little concern that any problems would arise from sharing each other's data, we prioritized allowing people to use it freely without imposing any restrictions.

The situation changed around the end of 2024. The number of tables has increased significantly, and we are now at the stage of expanding its use throughout the company. Isshiki said he felt that if the facility were opened without guardrails, troubles over authority would inevitably arise.

"We didn't rush to slam on the brakes after a problem occurred, nor did we impose our ideals from the beginning. We were very conscious of proactively setting rules half a step before usage spreads and new issues arise." (Mr. Isshiki)

The ``Data Management Infrastructure Operation Guidelines'' formulated in 2025 are not the creation of new rules from scratch. The operation and usage flow, which I had been trying to figure out until then, was now documented. Even artifacts created before the rules were enacted were retroactively corrected. This is a way to make the rules stick without stopping their use.

We also provide support for new users. In October 2025, the company opened an internal site, ``DM (Data Management) Portal,'' and in April 2026, it released a ``Starter Kit'' that beginners can self-teach how to use. User meetings are also held once every one to two months for users and operators to exchange opinions. This is to regularly ask what kind of data is needed and where they are having trouble, and reflect it in the infrastructure. An "Advanced Kit" to support more advanced utilization is also scheduled to be created and released in 2026.

Continuous governance supported by AI

Looking at the company-wide rollout, it became clear that there were issues that could not be addressed using the existing rules. Handling of personal and confidential information. ``At first glance, it may seem that the construction industry does not have much personal information.However, in reality, accident reports prepared for on-site safety management contain extremely sensitive information such as the names and health conditions of subcontractors and workers,'' Isshiki points out. If data is to be made available to all employees, it is necessary to first decide how to handle this information.

However, even within the data that is scheduled to be made available to the entire company, there are approximately 380 tables and 13,000 columns to be verified. Isshiki says that it is physically impossible to manually check each case one by one. Therefore, the company is working with primeNumber, which has received support from the start of the platform, to create a system that uses AI to determine the risk classification of tables and columns and generates metadata. At the time of his presentation, he was in the stage of implementing and verifying this mechanism. It was not started because of a problem, but rather an effort to organize the data on the platform ahead of the user registration of all employees scheduled for 2027.

We don't leave everything to AI. AI presents candidates and recommendations for high-risk personal information based on table structures and sample data. The final judgment and confirmation will be made by humans, and the results of human corrections will be used to retrain the AI. By dividing the roles of humans and AI in this way, we aim to create a system that can easily keep up with daily data updates.

Once the risk categories are clarified for each column, it will be possible to automatically determine masking and viewing privilege settings. "People don't have to worry about whether they can show this data every time," Isshiki says.

The effects of metadata are not limited to protection. When connecting a generated AI to in-house data, if the meaning and handling rules of the data are not defined as metadata, there is a risk that the AI ​​will mistakenly use data that should not be shown in answers. The same metadata is the foundation both when humans search for data in data catalogs and when AI makes sense of it.

"The metadata that we have developed for protection can directly become the source of resources for expanding the use of AI. That is what we are experiencing in the field right now." (Mr. Isshiki)

In the future, access control using metadata will speed up decisions on whether to release data. The aim is to create a system in which AI can automatically determine which data should be used and how. Many issues remain, such as continuing data maintenance, reviewing usage rules, and managing AI costs. Still, Mr. Isshiki called out to the audience as follows.

"We must not stop the movement to expand the use of data for the sake of defense.If we divide the decisions that should be made by humans and the work that can be left to AI, we can definitely balance expansion and protection."