Discussion: what should never be sent to an LLM or third-party automation tool?

A useful AI policy is more specific than “be careful with data.” Teams should identify categories that require approval or must never be shared: credentials, access tokens, payment details, health data, customer identifiers, confidential contracts, source code, or unreleased strategy information.

Redaction helps, but it is not a substitute for knowing where data goes and who can access it. The best policy is short enough that people can follow it in real work.

What data category would you explicitly block from your AI workflow today?

This should be required reading for every team pasting things into chatbots. 🔐 We once had a near-miss with an API key in a debug paste — caught it, rotated it, lesson burned in permanently.

Curious how you enforce it: block by tool, or block by data type? We found "never paste X" sticks better than "only use approved tools".