Putting business data into a prompt: a practical risk checklist

A prompt is a shipping label. Before you paste the spreadsheet, know what you are sending, who can see the transit, and what outlives the answer. Paste is already a data path (#12). This field note makes that path operational: three residues, a six-line checklist, short red lines, and a bridge to retrieval when the store never needed to enter the box.

---

1. Opener: Not a diary — a transfer

A prompt is not a diary. It is a shipping label.

The friendly chat face invites “for context.” That phrase is how whole customer tables, salary sheets, and credential-bearing logs travel into a path the sender does not fully own. The moral panic version of this advice (“never paste anything”) fails in practice. People paste because the task needs material. The ops version is sharper: treat every paste as a transfer with a sender, a payload, a transit, and a residue — then shrink or refuse with a checklist, not a gut feeling.

This piece sits in S3 AI × Data Security after #12 (when an AI tool becomes a data path). #12 sorted model-only setups from paths that already move data. Paste was named as the oldest everyday path. Here the claim narrows: make “paste into the box” operational. Separate sensitivity of the content, path of the request, and residue after the answer. No suite pitch. No invented retention percentages. claimState stays promise.

AI Caramba explains how business data enters AI systems. Named platforms appear later only when a Learn-backed fact is required. They are not the opener and not the product being sold here.

---

2. Three residues after you hit send

Before the checklist, name what can remain. One paste can leave three kinds of residue. Confusing them is how teams argue past each other — privacy about content, legal about transit, ops about copies — while the spreadsheet is already in three places.

(a) Content in the prompt

What you typed or attached is now inside the request: rows, names, IDs, free-text notes, maybe a secret that hitchhiked in a log line. This residue is the payload. Minimum paste shrinks it. Redaction shrinks it. “Dump the file and ask” maximizes it.

(b) Transit you do not fully control

The request leaves the session boundary toward a provider, a gateway, an enterprise capture point, or a hybrid stack. Logs, debug traces, and default retention sit on that transit. Soft product language (“we do not train on your data”) is not a full map of every store that touched the hop. If you cannot answer “where does this request go?” in one sentence, mark the gap as promise — do not invent a retention number to feel safer.

(c) Copies that outlive the answer

Tickets that quote the model reply. Screenshots in Slack. Forwarded threads. Exported chats. Shared workspaces that reopen yesterday’s paste. These second hops are often larger than the original model call: more readers, longer life, weaker revoke. The answer can be disposable; the residue often is not.

Three residues. One paste. The checklist below forces each into a plain sentence before send.

Pre-paste risk checklist

• Whose data is this? — Name the subject (customer, employee, household, yourself)
• How identified is it? — Names, IDs, account numbers, secrets, credentials
• How much does the task actually need? — Minimum paste beats "dump the file and ask"
• Where does the request go? — Hosted / local / hybrid — one sentence before send
• What is retained by default? — Unknown = promise; do not invent retention numbers
• Who else can reopen the thread? — Shared workspaces and forwards are second hops

Refuse or shrink a paste with this checklist in under a minute

---

3. Checklist: six questions before the paste

Use a checklist, not a gut feeling. Answer each line in one plain sentence. If a sentence stalls, shrink the paste or refuse until it unstalls. This is the operational core of the field note — Designo can mount it as the ac-checklist kit.

1. Whose data is this?

Name the subject — customer, employee, household, partner, or yourself. “Business data” is not a subject. If you cannot name who would be harmed by a leak or a wrong share, you are not ready to paste. Multi-subject dumps (“the whole CRM export”) fail this line on sight.

2. How identified is it?

List identifiers in the payload: names, emails, employee IDs, account numbers, contract IDs, secrets, credentials, health or financial markers. Identification is not a vibe. A “redacted” sheet that still carries unique combinations is still identified. If secrets or credentials appear, stop — that is a red line, not a checklist debate.

3. How much does the task actually need?

Minimum paste beats “dump the file and ask.” Ask what the model must see to do the job:

• Pattern or format question → one redacted example
• Row-level transform → one row, or a synthetic twin
• Policy / wording question → ask without the PII attached

Need-to-know is an ops verb. “Might help the model” is not need-to-know.

4. Where does the request go?

Hosted, local, or hybrid — answer in one sentence before you hit send. Include who operates the endpoint you actually reach (personal account, company tenant, on-prem box, vendor API via gateway). If the sentence needs a paragraph of guesses, you do not have path literacy yet. Paste into the unknown is still a path (#12); ignorance does not shrink blast radius.

5. What is retained by default?

Chat history, provider logs, enterprise capture, exports, “memory,” backups. Soft delete in the UI is not proof that every store forgot. Mark unknown as promise until a Learn-backed or contract-backed fact exists. Do not invent retention days, “zero retention” slogans without a named control, or fake percentages of safer setups. Unknown is an honest ops state. Fiction is not.

6. Who else can reopen the thread?

Shared workspaces, team seats, forwarded chats, ticket comments that embed the answer, screen recordings. Second hops turn a private paste into a small distribution list. If “only me” is false the moment a colleague opens the same project space, say so before you paste — or paste somewhere that cannot be reopened by default.

Six lines. Under a minute when the answers are known. Longer when they are not — and that delay is the control working.

---

4. Red lines: short, non-negotiable

Some pastes should not be negotiated down to “a little less.” Red lines are short on purpose:

• Secrets and credentials — API keys, passwords, session tokens, private keys, connection strings. Do not paste “just to debug the error message.” Strip first; rotate if they already left.
• Full customer dumps “just in case” — whole exports, full household tables, unfiltered ticket corpora pasted so the model can “see the landscape.” Landscape is a retrieval problem (#14), not a paste excuse.
• Regulated payloads you cannot name a lawful basis or internal allow-path for — if your own policy already forbids the transfer, the chat face does not create an exception.

If the model only needs a pattern, give a redacted example. If it needs a row, give one row. If it needs a policy question, ask without the PII attached. Shrinking is the default move. Refusing is the correct move when shrink still leaves a red line.

Red lines are not fear headlines. They are stop conditions — the paste equivalent of revoke mid-path in #12.

---

5. When you should not paste at all

Sometimes the right checklist outcome is no paste.

Retrieval can fetch what the model needs without shipping the whole store into the box. That is a different data path — fetch-then-generate — not a free pass. Unbounded retrieval can leak as badly as a careless paste; bounded retrieval can be the smaller residue when the alternative was “upload the warehouse.” The next piece (#14) covers that pipe: index → query → top-k chunks → prompt, and why usefulness and leakiness share it.

Other no-paste moves that stay inside this note’s spine:

• Ask a structure / policy question with synthetic examples only
• Work on a locally sealed tool that never leaves the machine — still name residue (a) and (c) for exports and screenshots
• Split the task so a human redacts, then the model sees only the safe remainder

“Do not paste” is not anti-AI. It is path selection. Paste, connect, retrieve, remember — #12’s four faces — remain available; the checklist decides which face fits the payload.

---

6. What this piece is not

Clear negatives save review time:

• Not a sermon. Guilt does not shrink payloads. Checklists do.
• Not a feature matrix or suite pitch. Buying a portal does not retire the six questions. Purview-no-Suite-Sell stays in force: when data platforms enter later pieces, frame govern / protect / manage and Docs-loyal names. Do not open with laundry lists, license SKUs, or leaderboard numbers.
• Not invented metrics. No fake “X% of pastes,” no traction theater, no retention days invented to fill a cell.
• Not a claim that chat is useless. Conversation UX is fine. The error is treating the box like a diary with no shipping label.
• Not a full RAG or agent treatise. Those are #14 and #15. This note stops at paste-as-transfer and the bridge.

Platforms — including Microsoft Purview and related Docs concepts such as govern, protect, and manage data in the era of AI — can appear when a Learn-backed fact is required. Order stays: category and checklist first; named controls only when a practice question needs them. kombify is not the subject of this line.

---

7. How this fits the reading path

Arc for the blog: Early Foundations → Data Security → AI × Data Security.

Current Lesepfad preference: S3-first if you already live with assistants and connectors. This field note is slot #13 — paste as transfer — immediately after the path opener (#12).

Light pointers (titles, not invented URLs):

• #12 — When an AI tool becomes a data path (paste already named; this checklist operationalizes it)
• #14 — Retrieval and RAG: useful, leaky if unbounded (when the data never needed to be pasted because it was fetched — still a path, never “free”)
• #15 — Agents that can act: blast radius before autonomy theater
• #16 — AI Security as a reading path: foundations → data → intersection

Rails stay navigation: this piece is a field-note. Pick the next article from the path; do not shop a suite.

---

8. Close: Shipping label, then send

A prompt is a shipping label. Three residues travel with it: content in the prompt, transit you do not fully control, and copies that outlive the answer. Six checklist lines make the transfer operational — whose data, how identified, need-to-know, where it goes, what is retained, who can reopen. Red lines stay short: secrets, credentials, full dumps “just in case.” Sometimes you should not paste at all; retrieval is the next path to bound, not a free pass.

Done when a reader can refuse or shrink a paste with this checklist in under a minute — without a gut feeling, without a suite pitch, and without inventing a retention number.

Status: draft / PROMISE. No publish. No Live wire from Caramba. No suite sell. No invented metrics. Review: kombinator2.

---

Series path: S3 AI × Data Security · slot #13 · rail field-note. Spine: three residues · six-line checklist · red lines. Next: #14 retrieval / RAG bounds.

 S3 first-wave · not final editorial · no suite pitch