Agent WranglersAPS-89Recommended
Send models only the private data they need
Send a model provider only the personal data a task needs, under terms that forbid training on it.
How to do it
Remove or mask names, emails, card numbers and health data before they reach the prompt, where the task allows. Choose a provider plan with no training on your data and a short retention period. Name the provider in your privacy policy.
How to check
Log the prompts sent for a test conversation. They contain no data the task did not need, such as full card numbers or other customers' details.
Sources
Related rules
- AIF-33 Check input before it reaches the model in AI features
- AIF-50 Train only on data people agreed to share in AI features
- CMP-19 Record the data terms of every AI provider in Compliance and governance
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/ai-features-and-agents/private-data-to-models">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.