Data levels: what can be handed to AI

A colleague is putting together a report on customer feedback. They have three kinds of material: published product descriptions, internal meeting notes, and an interview list with customer names and phone numbers. If they ask AI for help, can all three go straight in?

Most people's instinct is "it depends." The trouble is that "it depends" means someone has to think it through every time, and people get tired, rush and forget. This post explains how we turn that judgment into a label. Data carries its level from the moment it is created, and the level decides where it may go and who may see it.

Four levels, easy to remember

We sort all data into four levels. Too many levels and nobody remembers them, so nobody uses them. Too few and you cannot tell apart the things that really need protection. Four is where we landed.

• Public: material that can be published, such as live articles or product pages.
• Internal: for the team only, but harmless if it leaked, such as research notes.
• Confidential: ordinary case material, including client work and correspondence.
• Restricted: keys, ID numbers, lists of personal data, conversation transcripts, and the founders' own words.

Two rules matter most. First, anything unlabelled is treated as Confidential. It is deny-by-default thinking: better to protect a little too much than let data drift somewhere because someone forgot a label. New work starts life at Confidential.

Second, Restricted data does not leave the machine. It lives only on one assigned computer. It never enters version control, never goes to cloud AI, and is never part of the installer used to rebuild the environment. Every new project's ignore list ships with patterns for this level, and before every commit a check blocks paths that match those patterns and text that looks like a credential.

What AI can see

For the first three levels, AI reads according to the permissions it was granted. "According to permissions" is not something the AI decides. A separate gateway decides it: every request states who is asking, permissions are checked, and anything not explicitly allowed is refused.

For Restricted data, AI never sees the original. If the work truly needs that information, AI gets a masked summary with anything that identifies a person removed. Where the source names a contact and gives a phone number, the summary says "a contact at a manufacturer, interested in adopting AI." AI can still help analyse the need without holding data that identifies anyone.

Even for routine work such as tidying folders, the AI doing it does not read Restricted content. It may know a file exists there, but it does not open it. Tidying needs to know where a file is and what it is called, not what it says.

Isolation: how far apart work must be

Data level answers how sensitive a piece of data is. There is a second question: how far apart should a piece of work be from everything else? A confidential client project might hold mostly Confidential material and still need to be kept away from other work. That is what isolation level answers.

There are three. Standard work sits in the normal place, and the company index can read all its labels. Isolated work sits in a client area with its own repository, and the index receives only its status — where it stands, who it waits on. Strict work lives under a separate account or even a separate machine, and the index knows only that the work exists.

An example. A brand consulting project holds interview notes and proposal drafts that are mostly Confidential, but the client asks that even the project's existence stay hidden from people on other work. Data level stays as it is; isolation is set to Strict. The reverse also happens: internal research may sit at a low level and belong in the normal place, fully indexed, because many projects need to find it.

We keep the two levels apart because they answer different questions. Blend them into one score and you end up with no way to say "this data is not very sensitive, but this project really must be kept separate."

Who can change a level

A level is not set once and left. As work goes on, more sensitive material may be added, and the level has to rise with it.

Raising works like this. A program scans folders on a schedule. If it finds signs of personal data, such as runs of phone numbers or ID-number patterns, AI proposes an upgrade with its reasons and sends it to the person who owns that work. Once they agree, the level becomes Restricted and the work is flagged as containing personal data. If any single file is at the top level, the whole piece of work carries that flag.

A proposal can be wrong — a run of product codes mistaken for phone numbers, say. The owner replies "no," the level stays, and that decision is recorded too, so anyone asking later why it was not raised can find the reason.

Lowering has one path: the owner decides in person. AI cannot lower a level, and it cannot edit the source, authority or permission fields of any data. The reason is simple. Lowering a level lets data go to more places, and the consequences of that belong to someone who can answer for them.

AI may propose more protection. Only a person can grant less.

Derived data, and permissions as an overlap

New data computed from sensitive data needs care too. Take "industries of this quarter's closed deals," worked out from client records. The summary looks free of personal data, yet it was derived from it. Such data must be labelled with two things: what it came from and how far it has been de-identified. If people can still be recognised after the analysis, the level does not drop.

Then there are permissions themselves. What AI can actually do is the overlap of two ranges: what a person granted, and what its tools are able to do. Granted write but the tool can only read: it can only read. The tool can write but nobody granted it: it still cannot write. And AI cannot pass its permissions to another AI beyond what it holds.

Personal data has a few more basic rules: record the source, record whether the person agreed, keep only what is needed, store it on the assigned machine, mask it before it goes anywhere else, delete it when it is no longer needed or when the person asks, and review it regularly. None of this is complicated. The hard part is doing it every time, so we build as much as possible into defaults and checks rather than reminders.

In short

• Four levels; unlabelled means Confidential. The top level never leaves its machine, never enters version control, and AI sees only masked summaries.
• Data level and isolation level are separate: one is about sensitivity, the other about distance.
• AI may propose raising a level; only the owner may lower it. Derived data that still identifies people keeps its level.
• Effective permission is the overlap of what was granted and what is possible, and it is never passed on.