{"course":{"slug":"agents-and-automation","title":"Agents and Automation","url":"https://addaly.com/learn/agents-and-automation","level":"intermediate","track":"build"},"lesson":{"slug":"data-boundaries-and-redaction","title":"What leaves the building","url":"https://addaly.com/learn/agents-and-automation/data-boundaries-and-redaction","position":41,"of":72,"minutes":9,"answer":"Sending fewer fields is a control you can verify; stripping names out of free text is a reduction in exposure that should never be described as anonymisation.","keyIdea":"Sending fewer fields is a control you can verify; stripping names out of free text is a reduction in exposure that should never be described as anonymisation."},"body":{"format":"markdown","text":"## Draw the boundary before the pilot\n\nEvery automation that calls a hosted model exports data. Somebody will eventually ask what, to whom, and under what terms, and the answer should not be assembled in a hurry.\n\nFour questions, answered from the provider's current terms rather than from memory, because these terms change:\n\n1. **Is our data used for training?** Business and enterprise tiers generally say no by default; consumer tiers frequently say yes unless you opt out. The gap between those two sentences is where most organisational trouble starts, because somebody piloted on a personal account.\n2. **Where is it processed?** Region matters if any contract or regulation names one.\n3. **How long is it retained?** Many providers keep inputs for a period for abuse monitoring even when they do not train on them. Zero-retention arrangements exist on some enterprise agreements; they are not the default.\n4. **Who at the vendor can read it, and under what process?**\n\nWrite the answers down with the date you checked. That page is what your security review needs, and it takes twenty minutes.\n\n## Minimisation beats everything else\n\nThe strongest control is also the simplest: **send only the fields the task requires.**\n\nAn agent classifying a complaint needs the complaint text. It does not need the account number, the card's last four digits, the date of birth or the full address that happened to be in the same record. A model summarising a meeting needs the transcript, not the attendees' phone numbers.\n\nThis is verifiable in a way that most privacy controls are not. You can read the function that builds the payload and see exactly which fields it takes. You can write a test asserting that no other key appears. Nobody can do the equivalent for a redaction model.\n\nBuild the request from an explicit field list, never by serialising the whole record and hoping.\n\n## Redaction reduces exposure and does not anonymise\n\nReplacing names with placeholders before sending, then restoring them afterwards, is a useful technique. **Microsoft Presidio** does it as a free library; spaCy's named-entity models underneath it are free too.\n\nNow the honest part, because this gets oversold and the oversell causes real harm.\n\nEntity recognition misses things. It misses non-Western names more often than Western ones, because that is what the training data over-represents; so the population your redaction protects least is frequently the population that most needs it. It misses identifiers embedded in prose (\"the chap from the Bandra branch who joined in March\"). And even perfect name removal does not anonymise: a record with a postcode, a date of birth and a job title identifies a person in a small population without naming them. Combinations of quasi-identifiers re-identify, which is the finding behind decades of work on this and the reason regulators treat pseudonymised data as personal data.\n\nSo describe it accurately: redaction is defence in depth. It lowers what a leak exposes. It does not convert personal data into non-personal data, and any policy document that claims it does is inviting an unpleasant conversation later.\n\n## The local option is real\n\nA 7-to-14-billion-parameter model running on your own hardware never sends anything anywhere. **Ollama** makes this a two-line install; **llama.cpp** runs on a laptop CPU if you are patient and on modest consumer GPUs comfortably.\n\nThe honest trade: on classification, extraction, routing and rewriting, a small local model is often close enough that the difference does not change the decision. On hard multi-step reasoning and long documents, the gap to a frontier model is still large. That gap is the thing to measure on your own data rather than argue about, and if a local model clears your threshold, an entire category of data-boundary problem stops existing.\n\nA hybrid is often best: local model for the ninety per cent of records that are routine, hosted model for the escalations, with the escalation path minimised to the fields it needs.\n\n## The copies you forgot\n\nYour traces hold everything the agent read. Your error reports hold the payload that failed. Your prompt-caching layer holds recent inputs. Your evaluation fixtures may hold real customer records that somebody copied in during a busy week.\n\nEvery one of those is in scope for the same terms and the same deletion requests as the database. Put the trace store, the fixture set and the error logs on the retention schedule, and be able to demonstrate that a deletion request reaches all four.\n\n## One page, drawn\n\nSource, fields sent, processor, retention, deletion trigger. One line per flow. It fits on a page, it survives a change of staff, and it is the artefact that turns \"are we allowed to do this\" from a week of meetings into a five-minute read."},"check":{"question":"A team runs customer complaints through a redaction step that removes detected names before sending them to a hosted model, and describes the resulting data as anonymised. Why is that description wrong?","options":[{"text":"The redaction happens after the data has already been logged, so the original text is stored anyway.","correct":false,"tempting":"Log copies are a real problem worth fixing, but they are a separate failure from whether the redacted text itself identifies anyone."},{"text":"Entity recognition is imperfect and combinations of remaining details (postcode, dates, role) identify individuals without any name present.","correct":true},{"text":"The provider may still train on the data, which makes the anonymisation claim moot.","correct":false,"tempting":"Training terms matter, but they change what happens to the data rather than whether the data identifies a person."},{"text":"Restoring the names afterwards means the mapping exists, so the process is reversible by design.","correct":false,"tempting":"A local mapping is deliberate and controlled; the flaw is that the text sent onwards is identifying even without the mapping."}]},"prev":{"slug":"least-privilege-for-agents","title":"Give it the smallest key that works","url":"https://addaly.com/learn/agents-and-automation/least-privilege-for-agents"},"next":{"slug":"sandboxing-what-it-runs","title":"Running code the model wrote","url":"https://addaly.com/learn/agents-and-automation/sandboxing-what-it-runs"},"authorship":"Founder and series editor: Dr Mustafa Mun. Written by AI models to a written standard. Exam keys checked blind by a second model: 3,665 of 3,666 agreed. Academic review invited.","review":{"status":"Draft, open for academic review"},"cite":"Addaly (2026) 'What leaves the building', in Agents and Automation. Edited by M. Mun. Addaly. Available at: https://addaly.com/learn/agents-and-automation/data-boundaries-and-redaction (Accessed: 13 October 2026).","licence":{"name":"CC BY-NC-SA 4.0","url":"https://creativecommons.org/licenses/by-nc-sa/4.0/"},"reader":{"schema":1,"title":"What leaves the building","courseTitle":"Agents and Automation","module":{"index":5,"slug":"safety-and-blast-radius","title":"Permissions, injection and blast radius"},"answer":null,"keyIdea":"Sending fewer fields is a control you can verify; stripping names out of free text is a reduction in exposure that should never be described as anonymisation.","hero":{"kind":"plate","image":null,"alt":null,"caption":null},"blocks":[{"t":"h2","id":"draw-the-boundary-before-the-pilot","runs":[{"text":"Draw the boundary before the pilot"}]},{"t":"p","runs":[{"text":"Every automation that calls a hosted model exports data. Somebody will eventually ask what, to whom, and under what terms, and the answer should not be assembled in a hurry."}]},{"t":"p","runs":[{"text":"Four questions, answered from the provider’s current terms rather than from memory, because these terms change:"}]},{"t":"ol","start":1,"items":[[{"text":"Is our data used for training?","b":true},{"text":" Business and enterprise tiers generally say no by default; consumer tiers frequently say yes unless you opt out. The gap between those two sentences is where most organisational trouble starts, because somebody piloted on a personal account."}],[{"text":"Where is it processed?","b":true},{"text":" Region matters if any contract or regulation names one."}],[{"text":"How long is it retained?","b":true},{"text":" Many providers keep inputs for a period for abuse monitoring even when they do not train on them. Zero-retention arrangements exist on some enterprise agreements; they are not the default."}],[{"text":"Who at the vendor can read it, and under what process?","b":true}]]},{"t":"p","runs":[{"text":"Write the answers down with the date you checked. That page is what your security review needs, and it takes twenty minutes."}]},{"t":"h2","id":"minimisation-beats-everything-else","runs":[{"text":"Minimisation beats everything else"}]},{"t":"p","runs":[{"text":"The strongest control is also the simplest: "},{"text":"send only the fields the task requires.","b":true}]},{"t":"p","runs":[{"text":"An agent classifying a complaint needs the complaint text. It does not need the account number, the card’s last four digits, the date of birth or the full address that happened to be in the same record. A model summarising a meeting needs the transcript, not the attendees’ phone numbers."}]},{"t":"p","runs":[{"text":"This is verifiable in a way that most privacy controls are not. You can read the function that builds the payload and see exactly which fields it takes. You can write a test asserting that no other key appears. Nobody can do the equivalent for a redaction model."}]},{"t":"p","runs":[{"text":"Build the request from an explicit field list, never by serialising the whole record and hoping."}]},{"t":"h2","id":"redaction-reduces-exposure-and-does-not-anonymise","runs":[{"text":"Redaction reduces exposure and does not anonymise"}]},{"t":"p","runs":[{"text":"Replacing names with placeholders before sending, then restoring them afterwards, is a useful technique. "},{"text":"Microsoft Presidio","b":true},{"text":" does it as a free library; spaCy’s named-entity models underneath it are free too."}]},{"t":"p","runs":[{"text":"Now the honest part, because this gets oversold and the oversell causes real harm."}]},{"t":"p","runs":[{"text":"Entity recognition misses things. It misses non-Western names more often than Western ones, because that is what the training data over-represents; so the population your redaction protects least is frequently the population that most needs it. It misses identifiers embedded in prose (“the chap from the Bandra branch who joined in March”). And even perfect name removal does not anonymise: a record with a postcode, a date of birth and a job title identifies a person in a small population without naming them. Combinations of quasi-identifiers re-identify, which is the finding behind decades of work on this and the reason regulators treat pseudonymised data as personal data."}]},{"t":"p","runs":[{"text":"So describe it accurately: redaction is defence in depth. It lowers what a leak exposes. It does not convert personal data into non-personal data, and any policy document that claims it does is inviting an unpleasant conversation later."}]},{"t":"h2","id":"the-local-option-is-real","runs":[{"text":"The local option is real"}]},{"t":"p","runs":[{"text":"A 7-to-14-billion-parameter model running on your own hardware never sends anything anywhere. "},{"text":"Ollama","b":true},{"text":" makes this a two-line install; "},{"text":"llama.cpp","b":true},{"text":" runs on a laptop CPU if you are patient and on modest consumer GPUs comfortably."}]},{"t":"p","runs":[{"text":"The honest trade: on classification, extraction, routing and rewriting, a small local model is often close enough that the difference does not change the decision. On hard multi-step reasoning and long documents, the gap to a frontier model is still large. That gap is the thing to measure on your own data rather than argue about, and if a local model clears your threshold, an entire category of data-boundary problem stops existing."}]},{"t":"p","runs":[{"text":"A hybrid is often best: local model for the ninety per cent of records that are routine, hosted model for the escalations, with the escalation path minimised to the fields it needs."}]},{"t":"h2","id":"the-copies-you-forgot","runs":[{"text":"The copies you forgot"}]},{"t":"p","runs":[{"text":"Your traces hold everything the agent read. Your error reports hold the payload that failed. Your prompt-caching layer holds recent inputs. Your evaluation fixtures may hold real customer records that somebody copied in during a busy week."}]},{"t":"p","runs":[{"text":"Every one of those is in scope for the same terms and the same deletion requests as the database. Put the trace store, the fixture set and the error logs on the retention schedule, and be able to demonstrate that a deletion request reaches all four."}]},{"t":"h2","id":"one-page-drawn","runs":[{"text":"One page, drawn"}]},{"t":"p","runs":[{"text":"Source, fields sent, processor, retention, deletion trigger. One line per flow. It fits on a page, it survives a change of staff, and it is the artefact that turns “are we allowed to do this” from a week of meetings into a five-minute read."}]}],"check":{"question":[{"text":"A team runs customer complaints through a redaction step that removes detected names before sending them to a hosted model, and describes the resulting data as anonymised. Why is that description wrong?"}],"options":[{"text":[{"text":"The redaction happens after the data has already been logged, so the original text is stored anyway."}],"correct":false,"tempting":[{"text":"Log copies are a real problem worth fixing, but they are a separate failure from whether the redacted text itself identifies anyone."}]},{"text":[{"text":"Entity recognition is imperfect and combinations of remaining details (postcode, dates, role) identify individuals without any name present."}],"correct":true,"tempting":null},{"text":[{"text":"The provider may still train on the data, which makes the anonymisation claim moot."}],"correct":false,"tempting":[{"text":"Training terms matter, but they change what happens to the data rather than whether the data identifies a person."}]},{"text":[{"text":"Restoring the names afterwards means the mapping exists, so the process is reversible by design."}],"correct":false,"tempting":[{"text":"A local mapping is deliberate and controlled; the flaw is that the text sent onwards is identifying even without the mapping."}]}],"order":[3,1,0,2],"why":null},"prev":{"slug":"least-privilege-for-agents","title":"Give it the smallest key that works","minutes":8},"next":{"slug":"sandboxing-what-it-runs","title":"Running code the model wrote","minutes":9}}}