Skip to content

GoAI 101 · Module 3

Context, Knowledge, and Trusted Government Data

When AI answers a government business question, what should it actually know?

Start Section 1
0 / 5 completed
Sync my progressJoin a session to keep progress across devices and share it with your instructor

Info

After you join, your completed lesson numbers are sent to your instructor together with your learner code, so they can see your progress. Use the codes your instructor gave you, and do not enter your name, company secrets or other personal data. Progress is kept with the rest of that session's data.

Learning objectives

  • Distinguish Prompt from Context, and understand Context Engineering's Include / Retrieve / Remember / Exclude.
  • Explain the basic concepts of RAG and Knowledge Retrieval, and the role of metadata, versioning, and source trust.
  • Identify public, internal-agency, personal, sensitive, and classified data, and data prohibited from third-party AI services.
  • Understand the data lifecycle, the risk of outdated sources, and how to handle conflicting sources.

Ground: Prompt and Context

10 min

Prompt vs. Context

A Prompt is "what is being asked this time"; Context is "the background information AI should draw on when answering." Conflating the two is often where government AI applications go wrong: a caseworker assumes a clearly written question is enough, forgetting that AI has no idea about internal procedures or case history unless given them.

  • Context Engineering sorts information into four categories: Include (put directly into the prompt), Retrieve (pulled dynamically), Remember (kept across turns), and Exclude (explicitly withheld).
  • Include: suited to small, always-needed, rarely-changing information, e.g. the complaint text itself.
  • Retrieve: suited to large, not-always-needed, updating information, e.g. a full regulation database.
  • Remember: suited to information that must carry over across multiple interactions, e.g. the case number and current status.
  • Exclude: information explicitly withheld, this does not mean "forgotten," it means "never provided in the first place."
Check yourself

A caseworker believes "if the question is written clearly enough, AI will know the right answer." What does this mainly overlook?

A caseworker believes "if the question is written clearly enough, AI will know the right answer." What does this mainly overlook?

Key takeaway: Prompt decides "what is being asked"; Context decides "whether AI can get it right"; most government AI quality problems trace back to poorly designed Context, not to an unclear prompt.

RAG, source trust, and lifecycle

14 min

RAG, source trust, and the data lifecycle

RAG (Retrieval-Augmented Generation) is the most common way to implement Knowledge Retrieval: before answering, AI dynamically pulls relevant content from a knowledge base and generates its answer based on what it retrieved. Government work often needs regulations, internal procedures, and past cases, and the quality and management of those sources directly determines how reliable a RAG answer can be.

Four management factors that make RAG reliable
FactorDescription
MetadataVersion, publish date, issuing unit, and other data describing the source itself, so both humans and systems can tell what it is
VersioningRegulations and procedures get revised; the knowledge base must reflect the currently effective version, not an old one
Source trustPrefer officially published, clearly sourced data over content of unknown origin or unverified
ProvenanceAn AI answer should be able to point to which source it drew on, for human verification, not just state a conclusion
  • Data lifecycle: data moves through published, effective, revised, and retired states, and the knowledge base must stay in sync or it will cite a retired rule.
  • Outdated-source risk: if a regulation is revised but the knowledge base is not updated in time, AI may generate an answer based on the old rule, and the caseworker may not notice.
  • Conflicting sources: when sources contradict each other (e.g. an old and new version both exist), a human should decide which to use, AI should never decide this on its own or silently ignore the conflict.
Check yourself

The knowledge base holds both an old and a new version of a procedure, and AI cannot tell which is currently effective when retrieving. Which response is most appropriate?

The knowledge base holds both an old and a new version of a procedure, and AI cannot tell which is currently effective when retrieving. Which response is most appropriate?

Key takeaway: How well RAG answers depends on the knowledge base's metadata, version management, and source trust; outdated or conflicting sources must always be resolved by a human, never left to AI's own judgment.

Government data classification

12 min

Government data classification: six tiers

Government data classification (a simplified teaching tier)
CategoryDescriptionMay it go to AI?
Public dataAlready publicly released information, e.g. announcements, public statisticsMay be used per agency policy
Internal agency dataAdministrative working data not released externallyDepends on data classification and authorization scope
Personal dataData that can identify a specific individualGenerally avoided; if used, de-identify first per applicable rules
Sensitive dataSpecial categories such as health or criminal recordsGenerally prohibited without a clear legal basis and authorization
Classified dataData under a formal classification levelProhibited from any unauthorized system or service
Data prohibited from third-party AI servicesData an agency policy or contract explicitly bars from leavingNever provided, no exceptions

Warning

Whether a given piece of data may be entered into a specific AI service depends on agency policy, contract terms, security controls, and data classification. This course teaches judgment, not a blanket authorization for all AI services.
Check yourself

A caseworker wants to paste classified document content into a public third-party AI chat tool to get a quick summary. Which judgment is most correct?

A caseworker wants to paste classified document content into a public third-party AI chat tool to get a quick summary. Which judgment is most correct?

Key takeaway: The six classification tiers are not terms to memorize, they are the question you should ask every single time before handing data to AI: "which tier does this belong to?"

Government scenario: context design for a complaint reply

12 min

Government scenario: context design for a complaint reply

Government scenario

A caseworker wants AI to help reply to a citizen complaint. Include: the complaint text itself (de-identified). Retrieve: relevant regulation text, the agency's own public handling principles for similar past cases. Remember: this case's case number and processing status. Exclude: other citizens' personal data, not-yet-public internal deliberations, classified document content.

  • This scenario shows how Include / Retrieve / Remember / Exclude can all appear in the same use case, complementing rather than excluding each other.
  • The Exclude list is often more important than the Include list: missing an item that should be excluded is usually far riskier than missing one that should be included.
  • Citation and provenance: an AI answer should be able to point to which regulation or handling principle it drew on, so the caseworker can check the draft item by item.

Info

Classifying candidate information into Include/Retrieve/Remember/Exclude is, after Module 1's Use Case Card, the first time "what this use case needs" becomes concrete enough to be implemented in a real system.
Check yourself

In the complaint-reply scenario, how should "other citizens' personal data" best be classified?

In the complaint-reply scenario, how should "other citizens' personal data" best be classified?

Key takeaway: Good context design is not about giving as much information as possible, it is about precisely deciding what to give and what must never be given; how rigorous the Exclude list is often determines whether the whole use case is safe.

Practice and application

12 min

Practice: What Should the AI Know?

Activity 3 continues the use case selected in Module 1, classifying every candidate piece of information as Include / Retrieve / Remember / Exclude, and filling in the Government Context & Data Canvas.

  1. List candidate information
    List every information source this use case might draw on.
  2. Classify as Include / Retrieve / Remember / Exclude
    Judge each source item by item.
  3. Mark the source and sensitivity
    For each Include/Retrieve item, note the owning unit and data classification.
  4. Write the exclusion reason
    For each Exclude item, write one sentence on why it is withheld from AI.
  • Government Context & Data Canvas minimum fields: Use Case, Required Context, Trusted Sources, Source Owner, Retrieval Method, Version / Freshness Rule, Metadata, Personal Data, Sensitive Data, Restricted Data, Exclude Rules, Citation Requirement, Conflict Resolution Rule, Retention / Memory Rule, Human Verification.
Check yourself

What should the "Conflict Resolution Rule" field in the Government Context & Data Canvas mainly state?

What should the "Conflict Resolution Rule" field in the Government Context & Data Canvas mainly state?

Key takeaway: This Canvas turns Module 3's judgment method into concrete rules that Module 4 (tool permissions) and Module 5 (governance) can directly reuse.

What next?