Privacy and compliance guardrails

Privacy and compliance guardrails

Why it matters: Privacy guardrails prevent accidental data leaks and compliance issues.

Goals

• Define what data is sensitive.
• Write redaction rules.
• Add a do-not-store rule.

Key definitions

• PII: Personally identifiable information (name, email, address, IDs) depending on context.
• Sensitive data: Anything that could harm a person or company if leaked (contracts, secrets, health, finance).
• Redaction: Removing or masking sensitive fields before processing.
• Data minimization: Using only the minimum data needed to do the task.

Workflow (step-by-step)

1. List data categories that must never be pasted into prompts.
2. Create a redaction checklist (replace names/emails with placeholders).
3. Add a prompt guardrail: do not request or store sensitive data.
4. Define escalation: if sensitive context is needed, use a secure workflow.
5. Test with a sample containing fake PII and ensure redaction works.

Example (good vs bad)

✅ Good: You redact data before using AI and you have clear escalation rules.

❌ Bad: You paste customer data into a prompt without redaction or policy.

Checklist

• Sensitive categories defined.
• Redaction checklist exists.
• Guardrail added.
• Escalation path exists.

Metrics / criteria

• Sensitive data incidents: 0.
• Measurable: You can say whether the output is correct/complete (pass/fail or a score).
• Effort: You can produce the result in 15–30 minutes using the workflow.
• Clarity: Another person can run your prompt and get a similar outcome.

Common mistakes + fixes

• Pitfall: Over-sharing data “just in case”. Fix: Minimize inputs and use placeholders.
• Pitfall: Vague instructions. Fix: Add constraints, examples, and a success checklist.
• Pitfall: One-shot prompting. Fix: Iterate: draft → critique → revise → verify.
• Pitfall: No validation. Fix: Add QA steps, tests, and explicit “what counts as done”.

Student tasks

1. Apply the workflow to one real work task related to privacy and compliance guardrails.
2. Create a small artifact: prompt, checklist, rubric, table, draft, or decision note.
3. Run one quality check and record what changed after the check.
4. Write a 3-sentence reflection: what worked, what failed, and what you will reuse.

Useful external sources

• OpenAI prompt engineering guide: https://platform.openai.com/docs/guides/prompt-engineering — Prompt structure, iteration, constraints, and evaluation habits.
• NIST AI Risk Management Framework: https://www.nist.gov/itl/ai-risk-management-framework — Risk framing, governance language, and verification mindset.
• OWASP Top 10 for Large Language Model Applications: https://owasp.org/www-project-top-10-for-large-language-model-applications/ — Practical AI safety risks such as prompt injection, leakage, and insecure output handling.
• Google People + AI Guidebook: https://pair.withgoogle.com/guidebook/ — Human-centered AI design, user control, feedback, and failure modes.

Bibliography

• OpenAI prompt engineering guide. https://platform.openai.com/docs/guides/prompt-engineering
• NIST AI Risk Management Framework. https://www.nist.gov/itl/ai-risk-management-framework
• OWASP Top 10 for Large Language Model Applications. https://owasp.org/www-project-top-10-for-large-language-model-applications/
• Google People + AI Guidebook. https://pair.withgoogle.com/guidebook/