Memo de privacidad para FAQ interno con Azure OpenAI

En un despacho fiscal, laboral o legal, un FAQ interno puede convertirse en buscador de casos de clientes. El riesgo no es solo el chatbot, sino la hoja que mezcla procedimientos públicos, nombres de clientes, notas de inspección, números personales, contratos y decisiones individuales.

Key Points

• Clasifica datos antes de probar Azure OpenAI.
• Las garantías cloud no sustituyen decidir qué entra en prompts, files, vectors y logs.
• Claude Code lee columnas, muestras ocultas, referencias públicas y roles.
• Personas deciden juicio profesional, privacidad, contratos, publicación, logs, RBAC y red.
• Mide tiempo de primera respuesta, errores, datos sensibles detectados y consultas.

Internal FAQ Workflow

Los objetos son filas de FAQ, notas de cliente, preguntas de Teams, plantillas públicas, procedimientos internos, roles Azure y reglas de logging. Primero se separan los datos antes de probar el modelo.

Official sources checked: Data, privacy, and security for Models sold by Azure, Foundry Models sold by Azure, content filtering, managed identity, RBAC, network, and monitoring. Related guide: Vertex AI sales FAQ memo.

What Claude Code Handles And What Humans Decide

Entrega a Claude Code títulos, categorías, URLs públicas, muestras ocultas, encabezados de políticas y roles Azure. No entregues nombres de cliente, números personales, direcciones, cuentas bancarias, detalles de inspección, contratos o conclusiones.

Claude Code classifies FAQ rows, detects sensitive columns, drafts RBAC and logging questions, and creates escalation notes. Humans decide professional judgment, privacy, contracts, publication, role assignment, network posture, and launch approval.

3 Use Cases

Use case 1: Split FAQ candidates

• Input: FAQ table, column names, public references, procedure headings, redacted samples.
• Output: safe for AI, human review first, never send.
• Human review: client name, personal number, contract, professional judgment, case details.

Use case 2: Draft the Azure memo

• Input: resource name, pilot team, RBAC candidates, log viewers, test environment, launch date.
• Output: owner, tester, log viewer, deployment manager, audit memo.
• Human review: admin rights, logs, privacy boundary, network decision.

Use case 3: Handle wrong answers or filter events

• Input: wrong answer, content filter event, staff question, repair owner, approver.
• Output: update FAQ, update prompt, route to human, or ban answer.
• Human review: professional decision, client explanation, publication, recurrence prevention.

Copy-Paste Prompt

Act as an Azure OpenAI adoption memo reviewer for a professional services office.
Classify internal FAQ candidates into safe for AI, human review first, and never send.
Check client names, personal numbers, addresses, bank accounts, contracts, case details, RBAC, logs, network, content filtering, and human review.
Do not change Azure settings.
Return the five rows to inspect today.

Working Check Code

// verify-internal-faq-ai-boundary.mjs
// No dependencies. Run with: node verify-internal-faq-ai-boundary.mjs
const faqCandidates = [
  {
    id: "faq-001",
    title: "年末調整の必要書類",
    audience: "internal",
    source: "public template",
    text: "扶養控除申告書、保険料控除証明書、住宅ローン控除資料の提出期限を確認する。",
    containsClientName: false,
    containsMyNumber: false,
    containsContractTerm: false,
    approvedForAi: true
  },
  {
    id: "faq-002",
    title: "A社の税務調査メモ",
    audience: "internal",
    source: "case note",
    text: "A社 代表 山田太郎 様。マイナンバー 123456789012。調査官とのやり取り。",
    containsClientName: true,
    containsMyNumber: true,
    containsContractTerm: true,
    approvedForAi: true
  },
  {
    id: "faq-003",
    title: "電子帳簿保存の確認順",
    audience: "staff",
    source: "internal checklist",
    text: "保存場所、検索項目、権限、変更履歴、例外対応を担当者が確認する。",
    containsClientName: false,
    containsMyNumber: false,
    containsContractTerm: false,
    approvedForAi: false
  }
];

const deploymentMemo = {
  dataPrivacyRead: true,
  contentFilteringRead: true,
  rbacOwner: "",
  privateNetworkDecision: "undecided",
  loggingPolicy: "",
  humanReviewOwner: "partner"
};

const problems = [];

for (const item of faqCandidates) {
  const sensitive = [];
  if (item.containsClientName) sensitive.push("client name");
  if (item.containsMyNumber || /\d{12}/.test(item.text)) sensitive.push("my number");
  if (item.containsContractTerm) sensitive.push("contract or case detail");
  if (item.approvedForAi && sensitive.length > 0) {
    problems.push({ item: item.id, fix: "remove from AI FAQ input: " + sensitive.join(", ") });
  }
  if (!item.approvedForAi && item.source !== "public template") {
    problems.push({ item: item.id, fix: "route to human review before Azure OpenAI testing" });
  }
}

if (!deploymentMemo.dataPrivacyRead) {
  problems.push({ item: "data privacy", fix: "read Azure data privacy notes before choosing data sources" });
}
if (!deploymentMemo.contentFilteringRead) {
  problems.push({ item: "content filter", fix: "read content filtering behavior and write escalation rules" });
}
if (!deploymentMemo.rbacOwner) {
  problems.push({ item: "RBAC", fix: "assign owner for who can deploy, test, and view logs" });
}
if (deploymentMemo.privateNetworkDecision === "undecided") {
  problems.push({ item: "network", fix: "decide public network, private endpoint, or pilot-only access" });
}
if (!deploymentMemo.loggingPolicy) {
  problems.push({ item: "logging", fix: "write what prompts, outputs, and request IDs may be logged internally" });
}

if (problems.length > 0) {
  console.table(problems);
  process.exitCode = 1;
} else {
  console.log("Internal FAQ AI boundary passed.");
}

Pitfall: Common Failure Cases

Do not mix client notes into internal FAQ. Do not skip office-side classification after reading cloud privacy notes. Do not grant broad access just because the office is small. Do not repair every wrong answer with prompt edits. Fix the memo with data boxes, role separation, logging policy, network decision, and human review.

FAQ

Q. What should the office create first?

A. A classification table, not a chatbot.

Q. Is removing client names enough?

A. No. Dates, amounts, contracts, case names, and conclusions can identify a case.

Q. Does content filtering prevent professional mistakes?

A. No. It helps with harmful content categories, not specialist judgment.

Q. What metric matters?

A. First-answer time, wrong-answer count, sensitive data findings, FAQ updates, and training inquiries.

Training And Consultation Signal

If FAQ candidates contain case details or access rules are unclear, start with a data and permission memo. This is a fit for formación ClaudeCodeLab.

What I Verified

I checked official Azure and Microsoft Foundry sources, CTA, executable JavaScript, internal link, external links, locale coverage, and queue removal. The first action is to classify 20 FAQ candidates into safe for AI, human review first, and never send.