Training access is a separate question from inference access
Training data access is the permission to use a dataset as input for training a model, and it's a genuinely different question from who may later query the resulting trained model through an inference endpoint. A dataset that warranted careful access control during training doesn't automatically stop being sensitive once training finishes — the resulting model can retain traces of what it was trained on, which is exactly why access to the training process deserves scrutiny in its own right, not an assumption that the data's sensitivity somehow resolves once a model exists.
Model inversion makes this concrete: an attacker attempting to reconstruct or infer specifics of the training data by analyzing the trained model's own behavior, rather than by accessing the dataset directly. A model can pose a real confidentiality risk to its own training data even when that dataset itself remains perfectly access-controlled, because the risk travels through the model's learned behavior, not through direct access to what it learned from.
Training access recurs; it isn't a one-time gate
Treating a training dataset's access controls as a single gate checked once at project start misses that the same sensitive data frequently gets reused for retraining, fine-tuning, or evaluation well after the original approval — each of those later uses is a fresh instance of the same authorization question, not something the first approval already settled once and for all.