Who it's for
Engineering leaders who must say what data agents may see.
You'll be able to
Write a one-page data rule that people and agents both follow.
Every prompt sends data somewhere. Decide in advance which data may go, so nobody decides it in the moment.
Four classes of data
Sort every piece of data into one of four classes. The class says where it may go.
| Class | Examples | Where it may go |
|---|---|---|
| Public | Released code and docs | Anywhere |
| Internal | Specs, plans, numbers, error details | Your repositories and machines, and a model provider as allowed below |
| Secret | Keys, passwords, tokens, private addresses | One machine, or a secret store. Never a repository |
| Personal | Anything about a real person: names, messages they wrote, health details | Only the system that needs it |
If you are not sure which class something is, treat it as the stricter one. The rules apply to people and to agents alike.
The four classes of data, from most open to most closed. Public: released code and docs. Internal: specs, plans, numbers, error details. Both may go to a model provider.
Then the line. Below it, nothing goes to an outside model provider. Personal: anything about a real person, such as names, messages they wrote, health details; a model on your own machines may see it only in the product that needs it, never while building. Secret: keys, passwords, tokens, private addresses; it stays on one machine, or in a secret store, never in a repository, and goes to no model.
If you are not sure which class something is, treat it as the stricter one.
What may go to a model provider
| Data | A model on your own machines | An outside model provider |
|---|---|---|
| Code, specs and docs | Yes | Yes |
| Internal data not about a person | Yes | Yes |
| Secret data | No | No |
| Personal data | Only in the product that needs it, never while building | No |
The table decides what may be sent at all. It is not a list of what is safe once sent.
Never in a log
Logs and events hold IDs, counts, times, results and labels. They never hold:
- secret data;
- personal data;
- the text of a user's message, or of a model's answer to a user;
- the full text of a prompt.
Before a log leaves a developer's machine, a cleaning step keeps only the fields the log format knows and drops any line where the secret scan finds something. Recordings, screenshots and demos show made-up users and made-up conversations only.
How long you keep things
Retention is part of the rule, not an afterthought. One working example:
| What | Kept for |
|---|---|
| Logs on a developer's machine | 30 days |
| Archived logs and CI results | 12 months |
| Recordings attached to pull requests | 90 days |
| The progress record | The life of the project |
Say who can read each one, too. Archived logs go to the project team. Secret data goes only to the people who run the machine that needs it.
Try it
Take the last week of your team's AI use. List five things someone pasted into a prompt. Put each in one of the four classes. If any was Secret or Personal, write your own version of the two tables above and share it with the team.