# Define where your data can go

Taiga Learning · Worksheet
https://taiga.training/en/lessons/data-boundaries/

Use fictional or approved information. Do not put secrets in this worksheet.

## Learning objectives
- Distinguish development-time data flows from application data flows.
- Identify evidence needed before sharing confidential data.
- Use fictional data without concealing important test conditions.

## Exercise
Draw two flows for a fictional expense application: development and production. Include the editor, agent, model provider, logs, database, and support access. Mark unknown recipients. Replace one real expense record with a fictional fixture that preserves the same test conditions.

## Your response
- Scenario and scope:
- Assumptions and open questions:
- Proposed answer or decision, with reasons:

## Verify your response
| Claim or criterion | Evidence or test | Result or gap | Owner |
| --- | --- | --- | --- |
| | | | |
| | | | |
| | | | |

## Next action
- Action, owner, and date:
- When will you review this response?

## Principle to retain
A working prototype does not establish where its data goes. Verify each recipient, purpose, permission, and retention rule before using sensitive information.

## Sources
- [GDPR: principles, processors and impact assessments](https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng)
- [OWASP: AI Agent Security](https://cheatsheetseries.owasp.org/cheatsheets/AI_Agent_Security_Cheat_Sheet.html)

This worksheet supports learning. Completing it does not itself authorize a production change.