The most important privacy decision in an AI workflow often happens before anyone writes a prompt. Teams must first decide whether the information is permitted, necessary, appropriately classified, and suitable for the AI environment they intend to use.
The pre-prompt decision
Do not make the prompt box the first control boundary
A prompt is only one point in a larger information flow that may include source systems, retrieval services, model providers, conversation history, logs, evaluation datasets, and downstream applications.
When a user pastes a document into an AI assistant, the organization may create new copies, new derived information, and new records. The model may summarize the text, but the surrounding service may also retain prompts, generate telemetry, expose content to connected tools, or use output in another decision. That is why privacy and security reviews should begin with the information and the mission purpose, not with the convenience of the interface.
Approved access to information does not automatically authorize every AI use of that information.TDG perspective
Purpose
Define the specific mission outcome, user, decision, and prohibited secondary uses.
Authority
Confirm that collection, processing, sharing, inference, retention, and reuse are permitted.
Environment
Verify that the selected AI service is approved for the information and the intended use.
Classify before use
Understand what the information contains and what it can reveal
Classification should consider direct content, combinations, context, and inferences. A field that appears harmless alone may become sensitive when joined with other information.
| Information pattern | Questions before AI use | Illustrative control response |
|---|---|---|
| Approved public information | Is it authoritative, current, and released for the intended audience? | Use the approved source, retain provenance, and prevent unreleased material from entering the same workflow. |
| Internal operational information | Could the content reveal internal decisions, system details, staffing, contracts, or nonpublic operations? | Use only an approved enterprise environment with access, sharing, retention, and logging controls that match the information. |
| Information about individuals | Does it identify a person directly, indirectly, or through combination and inference? | Confirm purpose and authority, minimize fields and precision, limit access, and involve the appropriate privacy officials. |
| Controlled or regulated information | Does the information fall under an agency handling category, contractual restriction, or sector requirement? | Use only an environment authorized for that category and follow the governing handling rules. Do not rely on a general enterprise label. |
| Credentials and security material | Could the input expose secrets, keys, tokens, vulnerabilities, architecture, or defensive configurations? | Exclude secrets and unnecessary security details. Use approved security workflows and tightly restricted tooling when analysis is permitted. |
| Proprietary or third-party material | Do licenses, contracts, procurement terms, or data-use agreements permit this processing? | Verify rights and provider terms before use, constrain reuse, and preserve source and disposition records. |
These patterns are an operating aid, not a replacement for an agency’s authoritative information classification, records, privacy, security, legal, and contractual requirements.
Minimize before protecting
Use the least information that can support the mission outcome
Encryption and access control are essential, but they do not remove the risk created by collecting or exposing information that the use case never needed.
Reduce fields
Exclude names, identifiers, notes, attachments, and attributes that do not contribute to the approved task.
Reduce precision
Use a range, category, region, or time period when exact values are unnecessary.
Reduce volume
Start with a representative sample or bounded document set instead of copying an entire repository.
Reduce persistence
Set explicit retention for prompts, outputs, conversation history, caches, feedback, and diagnostic logs.
Reduce identity
Where appropriate, tokenize, aggregate, mask, or de-identify information and evaluate remaining re-identification risk.
Reduce reach
Limit users, connected tools, retrieval sources, exports, and downstream actions to the approved boundary.
Match data to the environment
An enterprise license is not the same as authorization for every dataset
The deployment model, provider terms, configuration, integrations, and agency authorization determine what information may be processed.
| AI environment | Appropriate starting posture | Evidence to verify |
|---|---|---|
| Public consumer service | Limit use to information approved for public release and low-consequence activities. | Terms of use, retention behavior, training use, account controls, and prohibited-data guidance |
| Approved enterprise service | Use only the information categories and use cases covered by the organization’s authorization and configuration. | Contract terms, data-use commitments, tenant controls, identity model, logging, retention, region, and connected services |
| Agency-controlled AI platform | Apply the same purpose, minimization, authorization, testing, and records disciplines. Infrastructure control does not eliminate privacy risk. | System boundary, authority to operate, data flows, access decisions, model and component inventory, monitoring, and reassessment criteria |
Choose the environment after the data decision, not the data after the tool has already been selected.TDG perspective
A practical release gate
Require a small evidence package before operational prompting
The objective is not a new bureaucracy. It is a short, reusable decision record that allows privacy, security, mission, data, and delivery owners to reach the same conclusion.
01
Approved use statement
Mission purpose, authorized users, affected people, decisions supported, and prohibited uses.
02
Information map
Sources, fields, sensitivity, owners, movement, retrieval, outputs, logs, retention, sharing, and disposal.
03
Minimization record
What was removed, generalized, masked, sampled, separated, or prevented from persisting.
04
Environment decision
Provider terms, technical configuration, authorization boundary, identities, connected tools, and geographic or contractual constraints.
05
Control tests
Prompt leakage, retrieval boundaries, access enforcement, output handling, logging, export, and misuse scenarios.
06
Owner decision
Named mission, privacy, security, data, and operational owners with residual risks and reassessment triggers.
Applied scenario
Summarizing case notes without copying the whole case file
A bounded design changes the workflow before it changes the prompt.
Consider a team that wants AI to help produce a concise status summary from case-management records. The fastest approach may appear to be copying the entire record into a general assistant. That choice could expose identifiers, attachments, historical notes, third-party information, and details unrelated to the requested summary.
| Decision stage | Action | What it means in practice |
|---|---|---|
| Risky starting point | Move the complete record | The prompt contains more information than the task requires, and the organization may not know how the service retains, logs, or reuses it. |
| Governed pattern | Prepare a minimum input | An approved workflow selects only the necessary fields, removes direct identifiers when they are not needed, retrieves content according to the user’s authorization, and sends it only to an approved environment. |
| Evidence of control | Test the complete path | The team verifies source filtering, user access, prompt and output handling, logging, retention, downstream use, and the conditions that require reassessment. |
Leadership questions
Questions to answer before information reaches AI
Clear answers help teams distinguish an approved, bounded use from an informal experiment that creates unmanaged exposure.
- Question 01What exact mission outcome requires this information?
- Question 02Which authority permits the proposed collection, processing, inference, sharing, retention, and reuse?
- Question 03What information can be removed, generalized, sampled, masked, or retrieved only when needed?
- Question 04Is the AI environment specifically approved for this information category and use case?
- Question 05Where will prompts, outputs, telemetry, logs, and feedback persist, and who can access them?
- Question 06What test evidence and operational change would trigger a new privacy and security decision?
Selected references
Primary guidance informing this article
- NIST Privacy Framework 1.0
- NIST Artificial Intelligence Risk Management Framework
- NIST AI 600-1, Generative Artificial Intelligence Profile
- NIST SP 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information
- NIST SP 800-53 Revision 5, Security and Privacy Controls
- CISA and partners, AI Data Security Best Practices
- OMB Memorandum M-25-21
Privacy and Secure AI, Part 1 of 8
Good prompting begins with a governed information decision.
Organizations do not need to choose between AI usefulness and responsible information handling. They need a repeatable way to define the purpose, reduce the data, select the right environment, test the complete path, and preserve evidence of the decision.
