Prompt privacy: send only the fields needed for the task

Last updated: 4 Oct 20268 min read

tutorial

Minimize sensitive fields before assembling model context. Replace names and identifiers with scoped tokens when the decision does not require identity; keep the mapping in controlled application storage. Apply access checks before retrieval, mask secrets in logs, and set retention according to the data policy. The prompt can request discretion, but deletion and access control must be enforced by the surrounding system. Redaction should preserve the relationship needed for the task while preventing an unauthorized output from reconstructing a private record.

Decision in practice

A support assistant reviews whether 29 billing adjustments meet a published rule. It receives case tokens, dates, amounts, and the relevant rule; it does not receive bank account numbers or the full customer profile. The application keeps a temporary mapping from case token to internal record so an authorized reviewer can act later. A test checks that generated summaries include no bank digits and that a tool result cannot pull a different account into context. If an adjustment needs identity verification, the workflow pauses for a separate authorized step rather than expanding every prompt by default.

Allowed: case token, adjustment date, amount, policy clause.
Excluded: bank account, address, unrelated tickets.
Output: decision plus cited fields; no personal identifier.
Retention: follow the product's configured policy, outside the prompt.

Performance and operating cost

A smaller context reduces token use and exposure, though tokenization and access checks add application work. For N records, filtering is typically O(N) before prompt assembly; retrieval indexes can limit the set earlier. Measure private-field leakage in test outputs and logs, including error traces. Over-redaction can break matching, so test that the remaining fields still permit the intended decision. Do not promise that a model will forget data just because a prompt asks it to.