See the structure, then implement and verify with the notes.
Send only task-essential fields to the model. The server verifies identity, scope and write permission; retrieved text gains no authority.
What situation are you walking into?
The prototype works. The customer asks what leaves the network, what providers retain and which employees see purchase history. They need system facts, not a statement that security matters.
01 / Trace the complete data journey
Map browser, application, databases, model providers, tools, logs and backups. Record data categories, purpose, processor, location, retention and deletion for each. Logs and caches also carry risk. This learning site takes no real customer data or API keys.
02 / Masking, encryption and anonymity differ
Masking reduces exposure but other attributes may re-identify someone. Encryption protects storage or transit, not identifiability after decryption. De-identification and anonymization have different implications. Engage legal and security specialists for processing grounds, sensitive data and transfers.
03 / Enforce permissions outside the model
Enforce tenant, role, object and field scope at execution time. Do not rely on prompts to prevent cross-store access. Denials should not reveal whether sensitive records exist. Apply boundaries consistently to caches, exports and retrieval indexes, with cross-tenant tests.
04 / Cloud, private and hybrid are tradeoffs
Compare model quality, residency, networking, updates, operations and lifecycle cost. Private deployment is not automatic compliance; cloud is not automatically disallowed. Evaluate candidate models on the same tasks and budget hardware, backups, upgrades and incident response.
Put the method to work
A manual-support task needs model-specific troubleshooting evidence, not identity numbers or full order history. Remove unnecessary attributes and retest. Reduced context can lower exposure and cost when utility remains intact; other workflows require their own decisions.
Practice this week
- Map data flows and retention including logs and backups.
- Implement field and scope checks with allow/deny tests.
- Submit deployment tradeoffs and a masking utility comparison.
Acceptance checks
- Permissions do not depend solely on prompts.
- Anonymization, encryption and masking are distinguished.
- Critical risks have owners and verification evidence.
90 minutes: map every data exit
Map users, browser, server, model provider, retrieval, tool services and logs. Label each crossing with data class, identity, storage and owner. Mark unknowns explicitly; a deployment label is not a complete boundary map.
0–20 min: classify personal, commercial and public information. Define purpose, minimum fields, access and retention; have real arrangements professionally reviewed.
20–55 min: test store-A identity requesting store-B data, a document asking to ignore scope, and secret-bearing logs. Name the trusted enforcement point.
55–90 min: compare local, private-cloud and permitted external services by operations, cost, data paths and recovery, not by location alone.
Artifact excerpt · synthetic example
Actor: operator A
Identity: established server-side (not implemented by the kit)
Allow: minimized queries over authorized store-A data
Deny: store-B rows, raw personal IDs, secrets and arbitrary exports
Log: trace_id, tool, state and redacted summary
Retention: actual organization policy, not an invented default
Stop: unclear scope, expired authority or sensitive leakageInstructor review
A prompt saying “do not exceed permissions” is not enforcement. Test direct calls, tampered arguments and cache reuse; denial must have no business side effect.
An unseen field challenge ↗
A cross-tenant cache hit can be worse than a wrong answer. Explain tenant-aware keys, invalidation and reviewable logs.
Case studies for this module
Managed, private and hybrid are options, not safety rankings. Review data egress, secrets, networking, logs and ownership.
Does private deployment automatically ensure compliance?
Location is one condition, not a substitute for governance and legal evaluation.
References and further reading
国家市场监督管理总局 / SAMR ↗ · 中华人民共和国个人信息保护法2021-08-20 · 国家市场监督管理总局 / SAMROWASP ↗ · LLM01:2025 Prompt Injection2025 · OWASPNIST ↗ · AI Risk Management Framework查阅 / Accessed 2026-09-07 · NISTAnthropic ↗ · How enterprises are driving AI transformation with Claude2025-10-01 · AnthropicRead alongside the assignment and record design constraints and tests. Verify specifications against your deployment version.