Skip to content
Clairos Learn

Safety, privacy, and governance · Lesson 4 of 15 · 7 min

Locate sensitive fields

Sensitive-field review depends on context and policy. Distinguish operational metadata from credentials and personal data before exporting a diagnostic record.

Open the labCourse map
Mastery 0/3Run itExplain itApply it
learner@clairosSimulated AI Ops lab
learner@clairos:~ $
↑ history · Tab complete · Ctrl+C cancel · Esc, Tab to leaveExit 0

Understand the pattern

Sensitive-field review depends on context and policy. Distinguish operational metadata from credentials and personal data before exporting a diagnostic record.

Interpret the evidence

Exclude the access token and review personal-data fields before sharing.

A tempting mistake

Every field in a diagnostic JSON is safe to publish.

All names, measurements, prices, versions, and thresholds in this exercise are fictional training data. The evidence supports this bounded scenario, not a claim about a live provider.

Worked example and expected result
$ cat /opt/ai-lab/cases/aiops-safety-governance-004.json
{
  "fixture": "Fictional training data; not a live measurement.",
  "fields": [
    "request_id",
    "access_token",
    "user_email"
  ],
  "credential_field": "access_token"
}

Exit status: 0. The command completed successfully in the training fixture.

$ jq .credential_field /opt/ai-lab/cases/aiops-safety-governance-004.json
"access_token"

Exit status: 0. The command completed successfully in the training fixture.

$ printf '%s\n' 'exclude-access-token' > /home/learner/lab/aiops-safety-governance-004-decision.txt
(no output; exit 0)

Exit status: 0. The command completed successfully in the training fixture.

Try a variation

Name the assumption that would have to change for “exclude-access-token” to stop being the justified action. Do not silently replace missing evidence with a guess.

Explain it

What does the evidence in “Locate sensitive fields” justify?

Apply it elsewhere

A colleague concludes: “Every field in a diagnostic JSON is safe to publish.” What should you do?

Keep the momentum.

Complete the lab, then explain and apply the pattern.

Next: Check data retentionTry an incident drill

Anonymous lesson and mastery progress lasts for this session. Sign in to keep synced lesson XP between sessions; mastery stays device-local. No speed bonus, lost lives, or hint penalties.

Keep learning

  1. 01Review output redactionOutput redaction has to inspect the produced response, not just the original input. A model may repeat sensitive source material in a new wording or field.Practice
  2. 02Check data retentionRetention describes how long data is kept and for what purpose. A retention setting should match policy and actual deletion behavior, not just a label in a form.Practice
  3. 03Inspect access boundariesAccess boundaries limit which subjects can read or change which resources. Relevance to a task does not grant permission to cross a tenant or role boundary.Practice

Case methodology: evidence, limits, decision