The control pattern
Data asset
Sensitive user and portfolio information
Knobs
Collection, Consent, Redaction, Retention, Access, Deletion and auditability
Outcome
Useful personalisation with lower privacy risk
Measurement
See how to measure this below
What it is
Privacy treats sensitive information as a controlled asset rather than ordinary model context. The first and strongest knob is collection: data that is not necessary should not be gathered.
Additional knobs govern consent, redaction, retention, access, aggregation, deletion, and whether content may be used for product improvement. These controls should apply across logs, analytics, model prompts, caches, vector stores, exports and support workflows : deleting a visible profile while leaving derived copies elsewhere does not honour the user's intent.
Privacy is not simply a disclaimer. It is an architectural knob that determines what the system is capable of remembering and reusing.
The knobs in detail
Each row is one adjustable property of the data asset, and what moving it tends to do.
| Knob | What you adjust | Likely effect |
|---|---|---|
| Collection | What is gathered at all | The strongest control available |
| Consent | What the user agreed to | Governs every downstream use |
| Redaction | What is stripped before storage | Limits exposure in logs and prompts |
| Retention | How long data survives | Bounds accumulated risk |
| Access | Who may see it, and why | Separates identity from analysis |
| Deletion and auditability | What removal actually reaches | Makes the promise verifiable |
Applied: Stocks Assistant
A Stocks Assistant portfolio may reveal wealth, employer equity, trading behaviour, risk tolerance and financial goals. Separate identity data from analytical data where possible, restrict access by role and purpose, and avoid exposing one user's holdings in another user's retrieval context. Personal data should not enter a general distillation dataset by default. If examples are needed for training, use properly de-identified, aggregated or synthetic representations, and retain provenance showing what transformation occurred.
How to measure it
Evidence that the knob produced the intended behaviour, rather than shifting the problem elsewhere.
- Access-policy violations
- Deletion completion across every store
- Retention compliance
- Sensitive-data leakage in logs
- Percentage of features operating with minimised data
Common mistakes
Deleting the visible profile while derived copies survive in caches, vector stores and exports.
Letting personal data flow into a general training set by default.