# AI connector and data-flow review

Draw the path below with the actual products and storage locations. Include derived summaries and retained history.

Source → connector → retrieval / index → model processing → retained history → output destination

**Use case / owner:** ____________________

**Roles: data owner for each source / technology reviewer / approver:** ____________________

**Highest classification of information the assistant can reach, and whether that is intended:** ____________________

## Tool and provider register

| Provider / product | Plan or tier in use | Inputs used for training or product improvement? | Prompt and output retention | Processing location | Agreement in place (terms, data-processing addendum) | Administrative controls available to the firm |
| --- | --- | --- | --- | --- | --- | --- |
|  |  |  |  |  |  |  |

## Data path

| Stage | Data present | Identity / permissions | Retained copy? | Retention / deletion behavior | Responsible owner |
| --- | --- | --- | --- | --- | --- |
| Source |  |  |  |  |  |
| Connector / index |  |  |  |  |  |
| Processing provider |  |  |  |  |  |
| History / logs |  |  |  |  |  |
| Output |  |  |  |  |  |

**Credentials used by the connector (type, scope, storage location, rotation date, what happens on the owner's departure):** ____________________

**Other routes to the same provider that bypass this review (browser extensions, personal accounts, plugins, mobile apps), and how they are found:** ____________________

## Bounded checks

- [ ] An unauthorized test user cannot retrieve restricted content.
- [ ] Later permission removal is tested, including cache / index behavior.
- [ ] Source deletion and retained-copy behavior are understood.
- [ ] Retrieved instructions do not expand the authorized task; at least one test used source material containing planted instructions.
- [ ] Reading and consequential actions have distinct controls.
- [ ] Access-denied behavior is visible and appropriate.
- [ ] Output that flows into another system is validated or reviewed before that system acts on it.
- [ ] The index or embedding store is scoped to this use case and cannot be queried by other tenants, workspaces, or assistants.
- [ ] Usage and spending limits exist so a runaway loop or misuse is bounded.
- [ ] Retrieval and action logs exist, state who can read them, and have a retention period; they do not contain more source content than needed.
- [ ] People whose work is summarized or acted on know an assistant is involved where that matters.
- [ ] Connector shutdown and follow-up data handling are documented, including deletion of the index, history, and provider-side copies.

**Evidence / unresolved questions:** ____________________

## Decision

**Approved scope / decision owner / date:** ____________________

**Conditions attached to approval:** ____________________

**Change triggers requiring another review (new source, broader permissions, new model or provider, new output destination, provider terms change, incident):** ____________________

**Review cadence when nothing has changed:** ____________________

## Common failure modes

- The connector is granted tenant-wide read access because scoping was harder.
- Permission removal at the source leaves content in the index for days.
- The provider's consumer terms apply because someone signed up with a personal account.
- Nobody owns the connector's credential after its creator changes role.

This review covers one assistant's access to firm data. It does not establish the quality of its output; use the AI workflow release review for that.