REVIEWED / JULY 22, 2026
Protect the input
Set the data boundary before writing the prompt
Classify what may enter the workflow, what must be redacted, and what must stay out.
What this guide should leave behind
A short input rule separates public, approved internal, restricted, and prohibited information.
Work the boundary in this order
- 01
Name the minimum facts the task actually needs.
- 02
Separate public examples from customer, employee, financial, health, contract, credential, and regulated information.
- 03
Use fictional or safely redacted material for the first trial.
- 04
Verify current provider terms, retention, training use, access, deletion, and administrator controls before real data enters.
Foundations worth seeing
- Minimum data is defined.
- Prohibited data is named.
- Redaction has an owner.
- Provider handling is verified from current documents.