Whole personal-data records sent to an AI model

Build prompts, retrieval context and embedding inputs from an explicit per-task field allowlist or pseudonymised data, never a serialized whole user record.

In each prompt builder, retrieval formatter and embedding job, select only the fields the task needs (an allowed_fields projection, pydantic model_dump(include=...), or a typed DTO), replace direct identifiers with a pseudonymous id where the task does not need them, and redact PII in free text such as tickets or notes (for example Presidio AnalyzerEngine and AnonymizerEngine). Never pass json.dumps(user), JSON.stringify(customer), vars(profile) or account.model_dump() into a model or embedding call. Apply the same selection to what AI telemetry and prompt logs capture.

Where it goes: 7 prompt construction, 1 application source code, 10 logs and telemetry.

What reviewers look for: in files that call a model or embedding API, an explicit field projection, pseudonymous ids, or a redaction step before the call; no whole-object serialization of user, customer, account, profile or contact records into prompts, context or embedding inputs; prompt logging that records the minimised payload, not the full record.

user = db.get_user(uid)
prompt = 'Suggest a plan upgrade for this customer: ' + json.dumps(user)
resp = client.chat.completions.create(model=MODEL, messages=[{'role': 'user', 'content': prompt}])

ALLOWED_FIELDS = ('plan', 'monthly_usage_gb', 'tenure_months')
user = db.get_user(uid)
facts = {k: user[k] for k in ALLOWED_FIELDS}        # no name, email, address
prompt = 'Suggest a plan upgrade for this customer: ' + json.dumps(facts)
resp = client.chat.completions.create(model=MODEL, messages=[{'role': 'user', 'content': prompt}])

Engineering guidance, not legal advice. Each provision below may add its own details (a cadence, a deadline, a required notice element): open it for those.