Limit the input to the fields the task needs
List the required fields and identify any personal, financial, confidential, or otherwise restricted information. Leave unnecessary fields out. Replacing a name does not necessarily anonymize a record. Combinations of details may still identify a person or organization.
- Confirm the purpose and permission for using each source.
- Begin with synthetic or approved redacted examples.
- Inspect free-text fields and attachments as well as structured columns.
- Keep credentials, private keys, and unrelated records outside the workflow.
Trace processing, storage, and support access
Map retrieval, inference, tools, outputs, logs, backups, and support access separately. Check whether any component can send context to an external service. Record allowed destinations and who can approve exceptions, then test the resulting configuration.
Check source permissions during retrieval
A shared assistant should not make restricted content available to users who cannot access the original material. Review how source permissions, indexes, service accounts, and user identity interact. Test requests for out-of-scope documents, not only the questions the assistant should answer.
Include logs and tool actions in the review
Prompts and logs can contain the same sensitive details as source files. Decide which records are necessary, where they are held, how they are protected, and who can inspect or remove them. Before allowing a tool action, define its destination, scope, and approval requirement.
- Keep early outputs in draft-and-review mode.
- Check references and sensitive content before sharing a result.
- Record denial reasons without unnecessarily reproducing restricted material.
- Name an owner for access changes, incidents, and recovery.
Test the restrictions before adding production data
Use approved examples to exercise source restrictions, blocked destinations, missing approvals, failed tools, and recovery. Inspect the resulting records. The review should identify what has been demonstrated, what remains assumed, and what must be resolved before production data is introduced.