Privacy / retention sketch

Privacy is architecture, not a banner

GDPR-style privacy programs live with legal teams — but engineers implement retention, redaction, and data flow. Agent systems amplify privacy risk: prompts concatenate user PII, retrieved docs, tool payloads, traces, eval logs, and vendor inference logs across many sinks.

A privacy sketch diagrams classes, flows, retention TTLs, and redaction points — prerequisite for responsible capstone and production design reviews.

Data classification

Start with classes relevant to agent stacks:

Tag each pipeline stage input/output with class labels in diagram.

Callout — Legal advice boundary: This lesson is engineering practice, not legal counsel. Flag "legal review required" on jurisdictional claims.

Retention and deletion

Define TTL per sink:

• chat_logs: 30 days prod, 7 days staging
• traces: 14 days sampled
• eval_golden: indefinite in git (synthetic/anonymized only)
• feedback_queue: 90 days until labeled → archive or delete

Implement delete hooks on user account erasure — cascade run_id indexes, vector DB entries, blob artifacts.

Document right to access/export stub — engineering effort estimate even if not built in capstone.

Redaction in the pipeline

Placement (mirror guardrails lesson):

User input → [classify] → [redact PII] → LLM vendor
Tool result → [redact] → model context
Logs → [hash user id] → storage
Eval export → [strip PII] → git

Show before/after example in redaction_examples.md — email → [REDACTED_EMAIL].

Second-order injection: retrieved doc contains PII — redact at index time or retrieval boundary.

Vendor subprocessors

Table for capstone:

Note data residency requirements — VPC-only models if PII cannot leave region.

Threat sketch

Brief STRIDE-style bullets: spoofing user id, tampering logs, repudiation without audit, information disclosure via traces, denial via retention flood, elevation via confused deputy tool.

Link to authz from Uber lab.

DPIA engineering appendix

Data Protection Impact Assessment is legal-led; engineers supply data flow diagram, retention table, and subprocessors — your privacy_sketch is DPIA appendix draft. Flag gaps for legal rather than filling with guesses on lawful basis.

Encryption in transit and at rest

Mark on diagram: TLS to vendors, encryption at rest for trace DB, key management owner. Portfolio stub: env vars not committed; production uses secrets manager — one paragraph in sketch.

Cross-border inference

If user in EU and model inference in US, diagram shows transfer mechanism (SCCs, etc.) as legal review item — engineering notes region routing option via gateway geo rules.

Putting it together in practice

ShipAI treats this lesson as executable curriculum, not reading alone. Before marking complete, trace one real request through your portfolio stack and label where this lesson's concepts apply — even if the first pass is messy. Document what broke in the module README; that gap list becomes your next sprint.

Compare your implementation against the industry callouts cited earlier without copying their scale. Name one deliberate simplification you kept (mock auth, SQLite not Postgres, single-region deploy) and one simplification you refuse to ship without (no eval gate, no trace on mutating tools, no fail-closed guardrail on exfil cases). That contrast is what interviewers and graders look for.

Callout — Teach back: Explain this lesson's core tradeoff to a peer in five minutes without slides. If you cannot, re-read the failure modes section and add an example from your own run logs.

Common questions and misconceptions

"Is this overkill for a side project?" Side projects can skip pieces; capstones and production cannot skip knowing the pieces exist. You may waive cost accounting in v1 but your architecture diagram should still show where it would attach.

"Should I rewrite from scratch?" Extend what you built in prior modules — graders reward evolution, not parallel unused folders. Link file paths in your checklist.

"Which metric matters most?" The metric tied to user harm or revenue: policy violations, failed refunds, silent wrong answers — not vanity leaderboard scores.

Extension paths after the micro-project

After the micro-project passes smoke check, choose one extension aligned with your capstone pillar: tighten eval coverage, add a chaos or red-team case, or wire observability into SSE streams. Extensions belong in BACKLOG unless scope freeze explicitly includes them — avoids capstone death by optional polish.

Engineering problem (staff framing)

Prompts/logs are personal data. Retention, redaction, residency are requirements.

Diagram — Data lifecycle

flowchart LR
  Collect --> Minimize --> Store --> Retain[TTL] --> Delete

Precise definitions & mental model

PII, purpose limitation, encryption, vendor DPAs.

Tradeoffs — when to use what

Debug fidelity vs privacy.

Failure modes (interview + on-call)

Infinite log retention; sending PII to third countries unaware.

Production & OSS practices

Data map; DSR runbooks; default short TTL.

Micro-project: Redaction in pipeline

Ship:

1. privacy_sketch.md — diagram + data class table + TTL table.
2. Redaction middleware or function on input path (reuse eval guardrails if exists).
3. subprocessor_table.md for capstone vendors.
4. Example redacted log line vs raw (in docs only, no real PII).
5. Account deletion checklist stub listing sinks to purge.

Acceptance: diagram shows ≥5 stages with class labels and one redaction point.

Checklist

• privacy_sketch.md with diagram and TTLs
• Redaction implemented or extended on input path
• Subprocessor table with purposes
• Legal review flag where appropriate
• Deletion checklist stub committed