Governing Large Language Model Services for Confidential Microdata: A Decision Framework for National Statistical Offices

National statistical offices increasingly face requests to provide large language model (LLM) capabilities in secure research environments. The governance problem is to determine which service configurations, if any, can be supported safely on confidential microdata. These services challenge traditional statistical disclosure control because interaction is adaptive, systems may retrieve documents or call analytical tools, and outputs may appear plausible without being grounded in approved data. This paper proposes a governance framework that organizes each request as a sequence of decisions: whether an LLM is needed, which service mode is justified, which threat model applies, which controls are required, and what evidence must be reviewed before release. The framework spans deterministic pipelines, retrieval-augmented generation (RAG), tool-using agents, code-execution agents, linkage configurations, and fine-tuning.