Note

Guard the corpus, not the reply

Everything that enters a public chatbot's corpus can come out of its mouth. The confidentiality check that works happens at the door, document by document, not in a filter chasing every reply.

This site has a chat that answers from a collection of public notes. RAG, in the jargon. And RAG has a property that is easy to forget: whatever the model consults, someone can extract, they just have to ask the right way. There is no "internal context" in a corpus that a public conversation can quote.

I work as a consultant. Part of what I know comes with client names and internal system names attached. If a note carrying one of those names enters the collection, the chat will eventually serve it, in a reply nobody reviewed, to someone I will never meet.

The temptation is to filter the output: review each model reply before showing it. An output filter chases paraphrase in real time and fails silently. The false negative never announces itself.

The decision here was to fence the entrance. No note enters the collection without a check against a list of banned terms: names of systems, clients and products that are not mine to quote. One judgment per note, offline, with a verdict and a citable reason. A held note knows exactly why.

Two details make this fence worth anything. First, the list lives outside the repository. A list of confidential names is itself confidential; committing it would be the leak it exists to prevent. Second, the check fails closed: a missing, unreadable or empty list holds everything back. An environment error never becomes permission.

The fence is not watertight, and that was assumed from day one: term matching does not catch paraphrase. I catch paraphrase, reading every note before pressing publish. The fence exists so that button is never the only protection.

A clean corpus at the door makes the output clean by construction. Judging each document once, calmly, costs less than policing every reply in real time. And when it fails, it fails loudly, with a reason, instead of failing silently in front of a stranger.