Data that should never leave

Source code, credentials, health, children’s data, and unpublished incidents do not go to a model you do not operate — and they do not go into logs you cannot delete.

Redact before retrieve. If the chunking pipeline can see it, the prompt can leak it.

When in doubt, leave it out and tell the user what you refused. Silence looks like a bug; a refusal looks like a Guardian.