What you’ll get from this lesson: Distinguish where data is stored, where the model processes it, and what permissions tools have, then draw a data flow you can check.
Prerequisites: No software installation required. Prepare a work example that can be shared publicly or has had sensitive information removed.
In the original draft, I handled public information and private data separately. That approach is worth keeping, but security depends on the actual data flow. You cannot judge it solely by saying, “The data is on my own computer.”
First, Map Out Where the Data Goes
A file can stay on your local machine while the Agent sends its contents to a cloud model for processing. At a minimum, separately label where the file is stored, which program reads it, and which service receives its contents. The website redesign plan has also pointed out that saving files locally does not mean no data leaves your machine when you use a cloud model.
For this lesson, use a fictional sample or one with sensitive information removed to draw the flow. You do not need to open any actual private data.
Use Different Confirmation Processes for Public and Sensitive Data
When summarizing public news, first confirm that the content being sent consists only of public information you are allowed to use, without inadvertently including private notes, credentials, or company documents. Any usage restrictions on the public sources themselves still apply.
For sensitive personal or company information, first confirm that you are authorized to use and process it. Remove sensitive parts as needed, or evaluate a controlled local-processing approach. Even after choosing a local model, you must still check whether surrounding tools, synchronization, or logging will send the contents elsewhere. The model’s location is no substitute for checking the entire process.
Grant Read, Modify, and External-Sending Permissions Separately
Looking up a record, changing it, and sending it out are three different actions. Start by granting only the minimum scope needed to complete the task. If higher permissions are required, you decide whether to grant them.
The original draft says I should be notified and asked before private data is handled. When re-recording, these two things need to be separated. A notification lets you know what has happened; approval means an action cannot proceed until consent is given. If you claim there is an approval safeguard, an actual tool or program must block unapproved operations and leave a result that can be checked.
Use Rejection Cases to Check Whether the Rules Actually Work
Start in a safe demonstration environment using fake data and controlled tools. Specify a file or action for which access has not been authorized, check whether the system refuses it, and verify that the original data has not been modified or sent out.
Simply writing “do not read” in a prompt, or having the model verbally claim that it is secure, does not count as passing this test. MCP’s security documentation also identifies authorization, consent, and access boundaries as issues that need to be addressed.[4]
Today, Draw One Data Flow and Mark One Boundary
The worksheet only needs one task. Draw the data source, the reading tool, the model’s location, and the destination of the output. Then mark which step requires approval. Label anything unknown as unconfirmed rather than guessing.
The outcome of this lesson is being able to explain “which data will be sent where, and where the process will stop without consent.” Building actual security gates is left to later hands-on lessons.
👉 Start L1-01: build your first Agent →
L1 is free after you sign in. Start with L1-01, follow it step by step, and you'll have an Agent of your own.
Not ready to start yet? That's fine. Scroll to the bottom and tap "Next lesson →" to keep reading the free articles, then come back to L1-01 when you're ready.
Sources Checked
[4] Model Context Protocol, “Security Best Practices.” The original draft’s claim that data “will not be leaked” has been narrowed to a security goal that must be verified, rather than retained as an absolute guarantee.