Core•6–10 hours

Analytics Privacy & Lineage Gate

Build a privacy-aware AI analytics pipeline with data minimization, permission checks, lineage, egress controls, retention, and negative tests before sensitive context reaches a model.

data minimizationPII classificationaccess controllineageegress governanceprivacy testing

Scenario

Task

An analyst needs to study customer behavior, but the source dataset contains identifiers, contact data, internal notes, and fields that are unnecessary for the task. An AI tool can speed up analysis, but “we did not ask the model to show PII” is not a control. Prove that sensitive fields do not enter model or tool context without necessity, permissions match the task, and every published insight has lineage to an authorized source slice.

Step-by-step execution

1. Classify data by purpose, not convenience

Outcome: Only fields required for the specific analytical job enter the pipeline.

Tasks

→Inventory columns and derived fields
→Mark direct and indirect identifiers and sensitive categories
→Bind every field to an explicit purpose
→Remove or aggregate fields without task necessity

Checks

✓“Might be useful” is not a purpose
✓Derived fields inherit privacy classification from source inputs
✓The minimized view is reproducible from a version-controlled transformation

2. Separate the identity and permission plane from model reasoning

Outcome: The LLM does not decide which data a user is allowed to see.

Tasks

→Validate user or service identity before retrieval or query
→Apply row, column, and tenant filters before model context
→Treat external processors and tools as separate egress boundaries
→Set read-only as the default for analytics tools

Checks

✓Unauthorized data cannot appear in a prompt even after a direct request
✓Tool schema does not expand business authority
✓A cross-tenant negative test ends in deterministic deny

3. Build end-to-end lineage

Outcome: Every claim and artifact can be reproduced back to a specific version of authorized data.

Tasks

→Record source snapshot and version
→Store transformations and query hash
→Link output claims to source slices
→Record model/tool configuration and timestamp

Checks

✓Lineage does not stop at “AI generated”
✓A stale source or permission version is visible in the trace
✓A published artifact has a reproducible evidence path

4. Inject privacy failures

Outcome: Protection is demonstrated with negative tests rather than policy slides.

Tasks

→Attempt to request excluded PII through the prompt
→Simulate stale group membership
→Test tool/result leakage and logs
→Test deletion and retention propagation

Checks

✓Critical leakage blocks rollout
✓Logs do not retain raw sensitive payloads without explicit policy
✓Deletion or access revocation propagates through analytical cache, index, and context paths

Acceptance criteria

Every field in the AI-visible dataset has an explicit purpose and classification
Permission filtering happens before model/tool context and has negative tests
End-to-end lineage exists from source snapshot to published claim or artifact
External egress, logs, retention, and deletion propagation are documented and tested
Cross-tenant or unauthorized-field leakage is a hard blocker regardless of aggregate quality score