Draw the Data and Accountability Map

In this chapter

• Map inputs, outputs, logs, and retention assumptions
• Separate accountability from tool operation
• Identify questions that must be resolved before real data is used

Follow the copies

A workflow diagram should show more than the arrow from user to assistant. Information may also enter a browser history, application log, exported document, support ticket, or retained conversation. Harbor Pilot starts with synthetic service tickets stored in a local exercise folder. Its draft summaries go into a separate review sheet. No customer account, mailbox, or production system is connected. Label these facts explicitly rather than assuming everyone shares the same mental model.

Create a map with five boxes: source tickets, drafting step, draft storage, review record, and final internal handoff. Under each box, list the data fields and owner role. Synthetic fields might include ticket ID, product label, reported symptom, and requested next step. Contact information is unnecessary for learning summary quality, so exclude it. Removing unnecessary fields reduces the information you must protect and the number of questions you must answer.

Assign decisions and controls

Use an accountability table with decision, accountable role, operator, evidence, and escalation contact. The pilot sponsor decides scope; the workflow owner maintains instructions; the reviewer checks drafts; the security or privacy reviewer assesses proposed real-data use. One person may hold several roles in a small team, but the decisions should remain visible. 'The vendor handles security' is not a complete assignment of your organization's responsibilities.

Work through an example: an employee proposes pasting fifty real customer tickets into a personal AI account. The data map cannot confirm approval, retention settings, or contractual terms. The correct status is blocked pending authorized review, not 'safe because the sample is small.' Continue the educational exercise with fictional tickets. A missing answer on the map is a work item, not permission to invent a reassuring assumption.

Distinguish deletion from a button label

A delete button does not explain backups, logs, or copies. Ask about retention, export, deletion propagation, access, and incident contacts. Date and source the answers. Real deployments require appropriate organizational and legal review; this register is not a compliance determination.

Create the pilot data register

• Draw the five-box synthetic workflow and list every field stored at each step.
• Create five accountability rows for scope, data approval, draft review, incident response, and retirement.
• Add a proposed real-ticket upload as a blocked change request. Identify the unanswered evidence needed before anyone could approve it.

Expected checks

• No real personal information is necessary for the exercise.
• Every stored artifact has an owner role and a retention question.
• Unanswered questions remain visibly unresolved and do not become assumed vendor capabilities.

Check your understanding

A tool offers a delete-conversation button. What does that establish by itself?

• All provider backups and logs disappear immediately.
• The organization has met every privacy requirement.
• Only that a deletion action exists; its full scope still needs evidence.

Official tools & further reading

• UK NCSC: Guidelines for secure AI system development