Protect secrets and personal data during ingestion

Once sensitive text is chunked, embedded, logged and copied into evaluation files, deletion becomes harder. Apply data minimization and access policy before derived artifacts multiply.

Test deterministic examples

The RAG ingestion lab contains synthetic email, token and phone patterns.

from ingestion_cases import privacy_case

result = privacy_case()
assert result["counts"] == {"email": 1, "test_token": 1, "phone": 1}
assert result["all_examples_removed"] is True
assert result["production_completeness_claim"] is False
print(result["redacted"])

All three fixtures are replaced and the policy sentence remains. The .test address and test token are invented. Regex coverage is not a complete privacy or secret-detection system.

Decide whether content should enter at all

Inventory source purpose, lawful/approved use, access class, retention and external processors. Exclude unnecessary fields and entire document classes when the assistant does not need them. Retrieval authorization cannot undo inappropriate ingestion.

Scan raw input using layered detectors for credentials, identifiers and domain-specific sensitive data. Validate detectors against labelled samples and measure misses plus false positives. High-risk matches may block ingestion; lower-confidence matches may require restricted review.

Propagate protection downstream

Apply source access to chunks and vectors. Minimize logs and traces; avoid storing raw prompts by default. Review provider data controls, region and retention before sending content to embedding or generation APIs. Encrypt and limit access to every store.

Maintain lineage for deletion. Redacting displayed text while retaining the secret in a vector or raw trace is incomplete. Test backups, inactive index versions and evaluation exports under the retention policy.

The Generative & Agentic AI course treats privacy screening as an ingestion and operations responsibility, not a final prompt instruction.

Exercise

Create 30 synthetic sensitive and benign samples. Evaluate two detection layers, set block/review rules, and prove blocked values never appear in chunks, vectors, logs or offline eval exports.

Continue learning

This article is part of the RAG ingestion and document preparation sequence. Use the neighbouring tasks when you need the prerequisite or the next application.

• Review the prerequisite or neighbouring task in Create a synthetic policy corpus for RAG practice.
• Continue with Reindex a corpus without disrupting active readers.

References: NIST Privacy Framework and OpenAI data controls.