Skip to content
NTPU AI Learn

GoAI 101 · 6h · Module 3

Trusted Data, Tool Connection, and Permissions

What may AI know, look up, and do?

Start Section 1
  • Duration55 min
  • LevelCore
  • PrerequisiteNo required prerequisites
0 / 5 completed
Sync my progressJoin a session to keep progress across devices and share it with your instructor

Info

After you join, your completed lesson numbers are sent to your instructor together with your learner code, so they can see your progress. Use the codes your instructor gave you, and do not enter your name, company secrets or other personal data. Progress is kept with the rest of that session's data.

Learning objectives

  • Use Include / Retrieve / Remember / Exclude to decide what data AI may use, and recognize prohibited inputs by data classification.
  • Explain how source, version, and timeliness decide whether data is trustworthy, and why conflicting sources go to a human.
  • Distinguish the purposes of RAG, API, and MCP, and classify each tool action as query, write, or send.
  • Apply least privilege in the Data and Tool Permission Table: record access scope, approver, and limits, and design logs and failure fallback.

First half: what may AI know (trusted data)

11 min

Context: what AI should know before it answers

A prompt is "what we ask this time"; context is "the background information AI may draw on when it answers". AI does not know your agency's internal procedures or a case's history. However clearly the question is written, an answer can still lack a basis if the context was not designed. This module uses one simulated case throughout: a city government "complaint reply assistant", where AI drafts a reply and the case officer reviews it before anything is sent.

Four ways to handle context (illustrated with the complaint reply case)
ApproachWhen it fitsComplaint reply case
Include (put it in directly)Small, needed every time, rarely changesThe complaint text for this case (de-identified)
Retrieve (look it up when needed)Large, not always needed, gets updatedCurrently valid regulations and published handling principles
Remember (carry across turns)Must continue over several interactions; needs a stated retention periodCase number and processing status
Exclude (explicitly withhold)Irrelevant to the task, or not allowed to go to AIOther citizens' personal data, unpublished internal deliberations, classified documents

Info

The Exclude list often matters more than the Include list: missing one item that should have been excluded usually carries far more risk than leaving out one item that could have been included.
Check yourself

In the complaint reply case, which category best fits "other citizens' personal data"?

In the complaint reply case, which category best fits "other citizens' personal data"?

Key takeaway: The prompt decides what we ask this time; the context decides whether AI can answer with a basis. Sort Include / Retrieve / Remember / Exclude first, then design everything else.

11 min

Trusted sources and data classification: what may and may not be given

Before data goes to AI, ask two questions: is it trustworthy (source, version, timeliness), and may it be given (data classification and agency rules)? Only data that passes both moves into Include or Retrieve.

Government data classification (simplified for teaching)
ClassDescriptionMay it go to AI?
Public dataAnnouncements and public statistics already releasedMay be used, subject to agency policy
Internal agency dataAdministrative working data not released externallyDecide by classification and authorized scope
Personal dataData that identifies a specific individualAvoid in principle; if necessary, de-identify first and follow the rules
Sensitive dataSpecial-category personal data such as health or criminal recordsProhibited in principle; needs explicit legal basis and authorization
Classified dataOfficial data under a security classificationMust not go to unauthorized systems or services
Data barred from third-party AI servicesData an agency policy or contract says must not leaveMust not be entered, no exceptions
  • Source: prefer data officially published by the agency with a clear origin; AI answers should say which source they relied on so a person can check it.
  • Version: regulations and procedures get revised, so the knowledge base must reflect the version currently in force, not leave a repealed one in place.
  • Timeliness: live status (such as case progress) should be looked up now, not answered from stale content.
  • Conflicting sources: when versions or sources contradict each other, a person decides which one applies; AI must not pick on its own.

Warning

Whether data may be entered into a given AI service depends on agency policy, contracts, security controls, data classification, and applicable law. Agencies differ; this course teaches a method of judgment, not a blanket authorization.
Check yourself

A knowledge base holds both the old and new versions of a procedure, and AI cannot tell which one is currently in force. What is the most appropriate handling?

A knowledge base holds both the old and new versions of a procedure, and AI cannot tell which one is currently in force. What is the most appropriate handling?

Key takeaway: Data must pass two gates: trustworthy (source, version, timeliness can be verified) and permitted (classification allows it). Conflicts and exceptions always go to a person.

Second half: what may AI look up and do (tools and permissions)

11 min

Tool connection: RAG, API, MCP, and three kinds of action

The first half covered what AI may know; the second half covers what it may look up and do. Once AI connects to tools it does more than produce text: it can read, change system data, and even send things out. Different purposes call for different controls.

How RAG, API, and MCP differ in purpose
TechnologyMain purposeComplaint reply case
RAGRetrieve knowledge so AI answers with a basisRetrieve relevant provisions from the regulation and handling-principle knowledge base
APIAn existing, purpose-specific link between systemsThe progress-query interface of the official-document tracking system
MCPA standard way to discover and call tools, connecting many of themAI reaches several different systems in a consistent way, without custom links for each
Direction of data flow: who hands data to whom
  1. Source system or knowledge base
  2. Read (query)
  3. AI produces a draft or suggestion
  4. Case officer reviews and approves
  5. Write to a system or send externally
  • Query (read): only reads data; lower risk, can be opened first.
  • Write: adds, changes, or deletes system data; needs extra review, and first ask "can it be undone if wrong?"
  • Send: delivers an official document, notice, or reply externally; the effect cannot be recalled, so a person must approve.
Check yourself

Which statement best explains how RAG differs from API/MCP?

Which statement best explains how RAG differs from API/MCP?

Key takeaway: First separate the purpose (knowledge, query, action) and the action type (query, write, send); only then discuss how much permission to grant.

11 min

Least privilege, approval needs, and traceability

Four control points for tool permissions
Control pointQuestion to answerComplaint reply case
Least privilegeDoes AI get only the minimum access the task needs?Query only this case's progress fields, not the whole tracking system
Approval needWhich actions need an authorized person to approve before they run?Writing a closure status or sending an official reply always needs human approval
Execution log and sourceIs each call logged, and can the result be traced to its source and query time?Log the query, time, source system, and result
Failure fallbackWhat happens if the tool fails, times out, or returns a doubtful result?Stop automated handling and hand back to the case officer to proceed manually
Government scenario: query is fine, writing and sending need approval

AI may be authorized to query the progress of the official-document tracking system (query) and help prepare a draft reply. It should not be granted, by default, the ability to change a closure status or send the official reply itself. However complete the draft, there is still a step between "draft done" and "officially in effect" where an authorized person reviews and approves.

Warning

Judge risk by the impact of the action, not by how well AI has performed so far. High-impact actions (writes, external sending, payments, personnel matters) need human approval by default.
Check yourself

Someone proposes that, because AI drafts have been consistently high quality, it can skip approval and send replies directly. Which judgment is most correct?

Someone proposes that, because AI drafts have been consistently high quality, it can skip approval and send replies directly. Which judgment is most correct?

Key takeaway: Query and drafting can be widened gradually; the approval gate for writing and sending does not lapse because AI performs well. Every tool needs a log and a failure fallback.

Practice and application

11 min

Practice: the Data and Tool Permission Table

Building on the case and workflow from Modules 1 and 2, enter the data and tools this application will use into one Data and Tool Permission Table. The result goes into the integrated Canvas fields "Context and Data (contextAndData)" and "Tools and Permissions (toolsAndPermissions)"; you do not re-enter the case background.

  1. List the data and tools
    List every data source and system the workflow uses, one row each.
  2. Write purpose and source or access scope
    Explain why it is needed and where the data comes from (with version and timeliness), or how far the tool can reach.
  3. Write permitted actions and limits
    Mark query, write, or send, and state prohibited inputs and limits on irreversible actions.
  4. Name the approver
    For actions needing human approval, state who approves; for those that do not, state why.
  5. Add logging and fallback
    State what is logged and how a tool failure is handed back to a person.
  • Table columns: item (data or tool), purpose, source or access scope, permitted action (query / write / send), approver, limits.
  • Use simulated or de-identified data only; do not enter real personal data, classified material, or unauthorized sensitive information.
  • "A person checks it" is not a complete answer: write who approves which action and what evidence is left.
Check yourself

In a permission table, which row is the most complete?

In a permission table, which row is the most complete?

Key takeaway: A permission table that states data source, access scope, permitted action, approver, and limits is the shared basis for the Module 4 governance check and the Module 6 acceptance decision.

Save as PDF

What next?