Draw the data flow
List every source, processor, model provider, workflow platform, database, log, notification, and destination. Mark where personal, confidential, financial, or regulated information appears. Include failure queues and support tools, which are easy to forget.
For each transfer, record purpose, fields, legal or contractual basis, region, retention, access group, encryption, and deletion method. If the team cannot describe why a field moves, do not move it yet.
Minimize data and permissions
Least privilege also limits mistakes. An agent that drafts an update does not need permission to publish it. A document classifier does not need access to unrelated employee records.
- Send only the fields needed for the defined task.
- Use separate service accounts rather than personal credentials.
- Restrict API scopes and database roles to required actions.
- Start new agents with read-only access.
- Mask or tokenize sensitive values where the task permits it.
- Review shared folders and inherited permissions before indexing.
- Set an owner and expiry date for temporary access.
Review providers and contracts
Check where each provider processes and stores data, what it retains, whether customer data is used for model training, how subprocessors are handled, and which security controls are available on the selected plan. Confirm breach notification and deletion procedures.
Marketing pages are not the full agreement. Review the current terms, data processing addendum, privacy material, service limits, and enterprise controls that actually apply to the account. Requirements may rule out an otherwise convenient tool.
Control prompts, tools, and untrusted input
Treat external text and documents as untrusted input. A prompt inside an uploaded file should not override the system’s job or grant access to another tool. Separate instructions from retrieved content and validate tool arguments before execution.
Allow-list tools and destinations. Put limits on amounts, record counts, recipients, and time windows. Require a person to approve actions that create a contractual, financial, employment, access, or safety consequence.
Log enough, then delete on purpose
Logs should help answer who triggered the action, which version ran, what source record was used, what changed, and why the system stopped or escalated. Avoid dumping full prompts, documents, tokens, or personal details into every log event.
Set retention by purpose. Operational debugging may need days or weeks, while audit requirements may need a different record. Make deletion testable across the workflow platform, model provider, queues, storage, and backups where applicable.
Test failure and abuse cases
| Test | Expected behavior |
|---|---|
| Expired credential | Stop safely and alert an owner |
| Duplicate event | Produce one downstream action |
| Malicious document instruction | Treat it as content, not authority |
| Unauthorized user query | Return no protected content |
| Provider timeout | Retry only when the action is safe |
| Low-confidence classification | Enter a human review queue |
| Unexpected volume spike | Rate-limit and preserve evidence |
Prepare the operating controls
This checklist supports technical planning. It is not legal or regulatory advice. Organizations handling health, finance, children’s data, employment decisions, or other regulated work should involve qualified security, privacy, and legal specialists.
- Name the business owner, technical owner, and incident contact.
- Version workflows, prompts, models, and source collections.
- Define monitoring, alert severity, containment, rollback, and replay.
- Review access and provider changes on a scheduled basis.
- Train operators to recognize unsafe output and report it.
- Record exceptions, overrides, and lessons in the runbook.
Frequently asked questions
Is it safe to send company data to an AI model?
Safety depends on the data, purpose, provider terms, account controls, region, retention, and access design. Minimize the data and complete a documented review before sending confidential or personal information.
Should we store AI prompts and responses?
Store only what has a defined operational, audit, or improvement purpose. Remove unnecessary personal and confidential data, control access, and set a retention and deletion schedule.
What is prompt injection?
Prompt injection is untrusted content that tries to alter an AI system’s instructions or actions. Defenses include separating instructions from content, restricting tools, validating actions, limiting permissions, and testing hostile inputs.
Do we need a human in every AI workflow?
Not every low-risk step needs manual review. Human control is important where uncertainty or failure could create material harm, commitment, access, payment, or policy exceptions.
Primary sources and further reading
If this topic maps to a real process, document the current volume, exceptions, systems, data sensitivity, owner, and consequence of error before selecting a tool.
Request an automation audit
