What to redact before you feed documents to an AI assistant

A source document is a publication decision: once a fact enters the assistant's knowledge, the assistant treats it as quotable.

A company decides its assistant should answer from its own documents, so the answers carry the company's substance instead of a generic guess. Someone gathers the files and feeds them in, and the setup feels done. What gets checked is whether the wanted section made it through: the price list, the return policy, the product manual. Almost nobody rereads the whole document with the opposite question: what could a stranger extract from this file?

The honest mechanism is that grounding means the assistant can repeat whatever its sources contain, to whoever asks. A source document is a publication decision covering everything in it: the title, the margins, the pages nobody opened. Once a fact enters the assistant's knowledge, the assistant treats it as quotable, not as a secret stored behind a locked door. The review that happens before feeding is therefore the real access-control decision in the company, and everything after it is just asking politely.

The failures have a pattern. The price list fed in whole, with a valued client's name sitting in the file's name itself, and the assistant quoting that name to whoever asked. The internal policy pasted in for one section, with the staff salary bands one page below it, quietly inside the assistant's reach. The contract uploaded for reference that handed the assistant a counterparty's confidential terms to recite. In none of these did anyone intend to publish a secret. The secret entered as luggage with the section that was wanted.

The cause is rarely bad intent; it is a division of labor that never meets. The person who feeds the assistant wants the capability, faster answers, fewer repeated questions, and the person who owns the data sits somewhere else in the company, and the two rarely sit at one table before the upload. Read that way, the document gets checked for one thing only: is the wanted section in it? It does not get read for the inverse: what else is in it? The document holds both answers, and the assistant does not distinguish between them.

The practice lives before the button. Read the file as a stranger would, and extract what a stranger could take: names of people, identity numbers, employee data, keys and passwords, and anything a regulated file carries. Strip what is personal, secret, or regulated before it enters, and keep the sensitive original where access is controlled by role and permission, not by an assistant that answers everyone. And when in doubt, let the assistant answer from a summary written for publication rather than from the raw file, because a summary you authored has already been reviewed by you.

We build transparent AI and we feed it our own material, and the redaction pass is part of our pipeline, not an afterthought we recommend to others and skip ourselves. Guidance, not guarantees: what counts as regulated data, and what the rules require around it, is a question for licensed practitioners and for your own review of your data responsibilities, and providers differ in what they log and retain. The review before feeding belongs to your company, not to the tool. The simplest form of the rule: nothing enters the knowledge that you would not be willing to hear repeated.