SkarpChapter 3 of 3
Protecting Information and Keeping Humans Accountable
Explore why sensitive facts should not be placed into an unapproved AI system, how anonymization and minimum-necessary disclosure reduce risk, and why a human must review every output. Recognize situations requiring current court rules or a licensed attorney.
1. Treat a Prompt as a Data Disclosure
Prompts can travel
A prompt can include more than its visible words: attachments, chat history, metadata, and connected data sources may also be involved.
Approval is contextual
A tool is not safe merely because it is popular. Its authorization must match the sensitivity of the information and the intended use.
Before sharing sensitive material, ask: Where does it go, who can access it, how long is it retained, and can it be reused?
2. Identify Information That Needs Protection
Sensitive means more than a name
Private emails, financial records, health details, business strategy, credentials, and legal files can all require protection.
The jigsaw-puzzle problem
Exact dates, locations, roles, and unusual facts can identify someone when combined, even after direct identifiers are removed.
The more unusual the context, the less detail it takes to make material identifiable.
3. Use Minimum-Necessary Disclosure
Start generic
Ask for a structure, checklist, or template before offering facts from a real situation.
Narrow the input
For a payment-letter draft, a neutral summary is usually enough. Full files, addresses, bank details, and internal notes are unnecessary.
Less data, less exposure: share only what the task genuinely requires.
4. Practice: Redact, Generalize, or Stop
Make a three-part decision
Consider this prompt: "Summarize these notes from a confidential dispute involving a named company, a specific contract, internal emails, and a settlement position."
Pause and sort the details:
- Redact: names, email addresses, account numbers, signatures, file metadata, and quoted private messages.
- Generalize: replace exact figures, dates, locations, and unusual roles with broader descriptions when precision is not needed.
- Stop: do not proceed if the task requires confidential facts and the AI environment is not approved for them.
Then ask whether the task can be reframed: "Create a checklist for summarizing a contract dispute for counsel." Reframing preserves the useful learning task without exposing the dispute.
Anonymization lowers risk, but it is not a guarantee. Unique facts can still permit re-identification, especially when other information is available.
5. Human Review Is the Accountability Control
Confidence is not evidence
A polished answer can contain false facts, invented citations, contradictions, or misleading logic.
Verify at the source
Check claims, quotations, citations, dates, calculations, and applicable jurisdiction against authoritative original material.
AI may prepare a draft. A knowledgeable human decides whether it is accurate and fit for use.
6. Add a Review Gate Before Any Real-World Action
A review gate
Put a human checkpoint between AI output and any filing, message, payment, decision, or other real-world action.
Four actions
Trace, verify, judge, authorize. Reading the original authority is different from trusting an AI-generated citation.
More autonomy means more oversight, not less. Connected tools can act on large volumes of information quickly.
7. Key Terms
Quick review
Flip the cards and connect each term to a practical safeguard.
- Minimum-necessary disclosure
- Providing only the information needed for a specific task, rather than an entire file or history.
- Anonymization
- Removing or changing identifying details. It reduces risk but may not prevent re-identification from unique combinations of facts.
- Confabulation
- Confidently presented AI content that is erroneous, false, inconsistent, or unsupported.
- Review gate
- A required human checkpoint that verifies output before it affects a person, decision, filing, or external communication.
8. Check Understanding
Choose the safest next step
A person wants AI help organizing a sensitive legal situation, but only has access to an unapproved public tool.
Which approach best protects information while preserving useful help?
- Ask for a generic issue-spotting checklist without uploading confidential facts, then use an approved process or qualified professional for the real matter.
- Upload all documents, but remove only the person's name.
- Paste the facts in several smaller prompts so the tool does not see the complete story.
Show Answer
Answer: A) Ask for a generic issue-spotting checklist without uploading confidential facts, then use an approved process or qualified professional for the real matter.
A generic checklist avoids unnecessary disclosure. Removing one name is not enough when other facts can identify the matter, and splitting sensitive details across prompts does not eliminate exposure.
Key Terms
- human review
- Independent examination by a responsible person who verifies the output before relying on or acting on it.
- anonymization
- The removal or alteration of identifying details to reduce the chance that information can be linked to a person or organization.
- confabulation
- Confidently presented but erroneous, false, contradictory, or unsupported AI-generated content.
- approved AI system
- An AI tool authorized for a particular purpose and type of information after appropriate assessment of its data handling, security, and access controls.
- minimum-necessary disclosure
- Sharing only the smallest amount of information genuinely needed to complete a specific task.