Working with AI on sensitive data — the redaction pattern

When you must use an AI tool on data that has sensitive fragments, redact before sending.

## The pattern

1. **Identify** the sensitive fragments: names, account numbers, addresses, dates of birth, case IDs.
2. **Substitute** each with a placeholder: `CUSTOMER_A`, `ACCOUNT_REF`, `ADDRESS_1`.
3. **Track** the mapping in a local file the AI never sees.
4. **Send** the redacted version to the AI.
5. **Process** the response.
6. **Substitute back** using the mapping.

## Example

Input: "John Doe called about account 4521-9988 asking why payment from 2026-05-12 hasn't posted."

Redacted: "CUSTOMER_A called about ACCOUNT_REF asking why payment from DATE_1 hasn't posted."

Mapping (local file only): `{"CUSTOMER_A": "John Doe", "ACCOUNT_REF": "4521-9988", "DATE_1": "2026-05-12"}`

## When this is enough vs. not enough

Enough: internal-confidential data that is not regulated.
Not enough: PHI, FedRAMP-scoped CUI, ITAR — those require approved enterprise tools, not redaction.

Full guidance in the [LearnTrainAI Week 2 module](https://learntrainai.com).