Draw the path below with the actual products and storage locations. Include derived summaries and retained history.
Source → connector → retrieval / index → model processing → retained history → output destination
Use case / owner:
Roles: data owner for each source / technology reviewer / approver:
Highest classification of information the assistant can reach, and whether that is intended:
Tool and provider register
| Provider / product | Plan or tier in use | Inputs used for training or product improvement? | Prompt and output retention | Processing location | Agreement in place (terms, data-processing addendum) | Administrative controls available to the firm |
|---|---|---|---|---|---|---|
Data path
| Stage | Data present | Identity / permissions | Retained copy? | Retention / deletion behavior | Responsible owner |
|---|---|---|---|---|---|
| Source | |||||
| Connector / index | |||||
| Processing provider | |||||
| History / logs | |||||
| Output |
Credentials used by the connector (type, scope, storage location, rotation date, what happens on the owner's departure):
Other routes to the same provider that bypass this review (browser extensions, personal accounts, plugins, mobile apps), and how they are found:
Bounded checks
- [ ] An unauthorized test user cannot retrieve restricted content.
- [ ] Later permission removal is tested, including cache / index behavior.
- [ ] Source deletion and retained-copy behavior are understood.
- [ ] Retrieved instructions do not expand the authorized task; at least one test used source material containing planted instructions.
- [ ] Reading and consequential actions have distinct controls.
- [ ] Access-denied behavior is visible and appropriate.
- [ ] Output that flows into another system is validated or reviewed before that system acts on it.
- [ ] The index or embedding store is scoped to this use case and cannot be queried by other tenants, workspaces, or assistants.
- [ ] Usage and spending limits exist so a runaway loop or misuse is bounded.
- [ ] Retrieval and action logs exist, state who can read them, and have a retention period; they do not contain more source content than needed.
- [ ] People whose work is summarized or acted on know an assistant is involved where that matters.
- [ ] Connector shutdown and follow-up data handling are documented, including deletion of the index, history, and provider-side copies.
Evidence / unresolved questions:
Decision
Approved scope / decision owner / date:
Conditions attached to approval:
Change triggers requiring another review (new source, broader permissions, new model or provider, new output destination, provider terms change, incident):
Review cadence when nothing has changed:
Common failure modes
- The connector is granted tenant-wide read access because scoping was harder.
- Permission removal at the source leaves content in the index for days.
- The provider's consumer terms apply because someone signed up with a personal account.
- Nobody owns the connector's credential after its creator changes role.
This review covers one assistant's access to firm data. It does not establish the quality of its output; use the AI workflow release review for that.