Vibecoding for Business School Students
Module 5 · Page 1 of 4 · 20 minutes

Protect the information

Giving an agent context also means giving it access to information. Before you upload, connect, or expose data, decide what the agent actually needs to see.

Access is a decision

In earlier modules, we emphasized giving the agent enough context to do the job well. But more context isn't always better. Some information may be confidential, sensitive, regulated, or simply irrelevant to the task.

The key question is:

What does the agent need to see to complete this task?

Treat access the same way you would with a human teammate: give the agent what it needs, not everything you have.

Use the minimum necessary information

Suppose you're analyzing employee turnover and have a spreadsheet with:

If your task is to compare turnover rates across departments, the agent probably doesn't need every field.

Instead of uploading everything:

Give the agent only the fields needed for the analysis,
such as department, employment status, and resignation date.

Remove names, IDs, medical information, and other fields
that aren't necessary for the task.

This principle is sometimes called least privilege or minimum necessary access: give the system only the information and permissions required for the job.

Ask four questions before sharing data

Question Why it matters
Is this information sensitive? It may contain personal, confidential, financial, or proprietary information.
Does the agent need it? Irrelevant fields increase exposure without helping the task.
Can I reduce or redact it? You may be able to remove names, identifiers, or unnecessary detail.
Am I allowed to use this tool? Your organization or class may have rules about where certain information can be used.

Data can enter the agent in several ways

Information exposure isn't limited to copy-and-pasting text into a chat. An agent may gain access through:

The same question applies in every case: does the agent need this access for the current task?

Separate what is useful from what is sensitive

Imagine you're building a customer retention dashboard from a customer database.

You may need:

- purchase history
- customer segment
- tenure
- cancellation status

You may not need:

- full name
- home address
- phone number
- payment information

If those fields don't help answer the business question, leave them out.

Use safer versions when possible

Sometimes you need the structure of real data without needing the real identities behind it. In those cases, you can often reduce risk by changing what you provide.

Instead of… Consider…
Full customer records Removing names and direct identifiers
Production database access A smaller read-only extract
All company documents Only the files relevant to the task
Real sensitive data for early prototyping Synthetic or sample data

Company policy comes first

Even if a tool is technically capable of handling a file, that doesn't mean you're allowed to use it. Organizations may restrict which AI tools can be used with internal or confidential data.

Before using company information, check the rules that apply to your environment. If you're unsure whether a dataset can be used with a particular tool, ask rather than assume.

A useful rule

Give the agent enough information to do the job, but no more than it needs.

Good context design isn't only about helping the agent perform better. It's also about limiting unnecessary access.

Exercise

Imagine you're asked to build a dashboard showing patterns in employee turnover. Your source file contains names, employee IDs, salaries, departments, performance scores, leave history, hire dates, and resignation dates.

Before giving the data to an agent, decide:

  1. Which fields are necessary for the task?
  2. Which fields should be removed or redacted?
  3. Could you use a smaller or safer version of the dataset?
  4. What organizational rules would you want to check first?
Next · Page 2 of 4
Control what the agent can do
→