Responsible AI Foundations

A support assistant shipped in March. In June, a customer asked what the company stored about them, and the reply included chat transcripts nobody remembered keeping: full text with a name, an address, an order dispute, and a medication mentioned in passing. The feature had been sending complete transcripts to a model provider and writing raw copies into debug traces with a 180-day retention, because the first version needed the context and nobody took it out later.

Two mistakes, one root cause: more data was collected than the feature needs, and kept longer than anyone planned for. Both are fixed where the data leaves your building — when the request is assembled, not when the audit starts.

Inventory the fields first

Collect only what the feature needs: the inventory takes five minutes per feature and it is the data minimization policy in practice.

Redact at the boundary

import re

PATTERNS = [
    (re.compile(r'\b\d{3}-\d{2}-\d{4}\b'), '[SSN]'),
    (re.compile(r'\b(?:\d[ -]?){13,16}\b'), '[CARD]'),
    (re.compile(r'[\w.+-]+@[\w-]+\.[\w.]+'), '[EMAIL]'),
]

def redact(text: str) -> str:
    for pattern, token in PATTERNS:
        text = pattern.sub(token, text)
    return text

Regex is a floor, not a ceiling: it catches structured identifiers inside free text, while structured fields should be dropped by schema — delete the key while the payload is being built, so a later edit cannot quietly re-add it. Shaping and trimming the payload is plain dict and comprehension work (Python Data Structures for API Work).

What remains is diligence rather than code: does the provider retain inputs, train on them, and under which agreement? Settle that before the first prototype ships — it is the privacy half of the scoring you do in Identifying Valuable AI Use Cases.

The audit question arrives six months late: what did the system decide, and who approved it? The instinctive fix — dump inputs and outputs into a trace — recreates the incident above. The workable compromise is a record that reconstructs the decision while leaving the person out of it.

What an audit record holds

• Request id and timestamp.
• Model identifier and version, plus the prompt version or its hash.
• Redacted input and the output: enough to replay the reasoning, not enough to identify the customer.
• Decision taken, and the reviewer's id when a human signed off.
• Appeal outcome, if the user contested it.

Correlate without storing: hash the customer identifier with a keyed hash (HMAC) so records still join to each other while the raw value never lands in the log. When a reviewer genuinely needs the raw value, that lookup goes through a system with access control and its own retention clock — not through the trace store.

user request
     |
     v
[redact] --> [model call] --> [validate] --> [user sees the answer]
     |                              |
     +------------------------------+
                    v
      audit record: request id, model + prompt version,
      redacted input, output, decision, reviewer id
                    |
                    v
     append-only store · short retention · access logged

Production note: debugging traces are data stores. The same redactor has to run on the path that writes them, and a line emitted by a library is not exempt because nobody wrote it by hand. Teams that treat "just for debugging" as an exception are the ones reconstructing customer transcripts during an access request.

Not every output deserves the same supervision. Human review checkpoints keep people accountable for high-impact automated decisions, and the ladder follows impact rather than convenience:

The middle row is where products usually go wrong. An automated denial with no person in the loop means nobody is accountable for the rule that produced it, and a checkpoint placed carelessly becomes a rubber stamp — Human Review Workflows covers where to put it so the reviewer actually reads the case.

Tell the user, and give them a way back

Disclosure is part of the feature, not text underneath it:

• "Drafted with AI — reviewed by support" on the message the customer receives.
• A visible signal when the party on the other end is a model rather than an agent.
• An appeal path with a promised turnaround: "Reply DISPUTE and a human reviews this decision within two business days."

Disclosure does two jobs at once. Users calibrate how much to trust the output, and a wrong outcome has somewhere to go. Without the appeal path, a wrong automated decision is simply final, which is how a support issue becomes a regulatory one.

Before launch, run the abuse pass with the rest of the test suite: adversarial inputs, jailbreaks, and injected instructions belong in the same suite as functional cases (Prompt Injection Attack Patterns, Red-Teaming AI Systems). Pair it with an outcome check across user segments, so a feature that performs on average does not fail one group systematically and go unnoticed.