Do Not Send the Whole CRM to an AI Tool Because the Prompt Was Easier

“Personalize the campaign” is too vague to justify broad access. Name the task: classify an inbound request into an approved service category, summarize three selected notes for the record owner, or draft a reply from an approved knowledge base. Then list the minimum inputs and outputs.

Separate public content, internal business data, customer data, sensitive data, and secrets. A model rarely needs raw API keys, full histories, unrelated contacts, or every CRM property to complete one bounded marketing task.

Document the source system, application database, prompt construction, provider endpoint, retrieval index, cache, observability platform, error logs, human review queue, export, backup, and deletion mechanism. NIST’s Generative AI Profile emphasizes risks across third-party components and data sources; responsibility does not disappear at the API boundary.

For each location record the purpose, fields, owner, access, region where relevant, retention, training or improvement setting, incident contact, and deletion path. Verify current vendor terms and account configuration rather than copying a generic product claim.

Prefer field allowlists, aggregation, scoped record references, and retrieval after authorization. Pseudonymization can reduce exposure but does not automatically make data anonymous when another system can reconnect the identity. Do not place secrets in prompts and expect instructions to protect them.

Use separate development and production data, synthetic or de-identified test fixtures, role-based access, short-lived credentials, and project-level limits. OpenAI states that business and API data is not used for model training by default, with configurable controls for qualifying organizations; other providers and product tiers require their own review.

Test access removal, retention expiry, deletion, backup behavior, exported logs, failed requests, support access, and vendor offboarding. Re-run the map when a model, tool, integration, feature, region, or policy changes.

Monitor unexpected fields, sensitive-output detections, failed redaction, retrieval authorization, deletion backlog, and user reports. Good governance makes the permitted path easier to use than copying a spreadsheet into an unapproved chat.