Map where the data goes
Before uploading a document, understand which service receives it, what is retained, and who can access the result. Keep credentials out of prompts and browser code. Minimize personal information in development examples. Use synthetic records for testing. A private interface alone does not establish private processing; storage, model requests and logs each need appropriate controls.
Separate suggestions from actions
An assistant can propose a timeline entry, draft an email or suggest a relationship between records. Those outputs should remain reviewable suggestions until approved. Keep the original text beside the interpretation. Avoid letting untrusted document content authorize an email, deletion or permission change. Tool access needs explicit boundaries independent of how persuasive an instruction sounds.
Record uncertainty and provenance
Distinguish a direct quotation from a paraphrase and an inference. A shared name or label does not establish that two records describe the same person. For an extracted event, retain the date as written, its source and any ambiguity. Keep a correction path so reviewed facts can be updated without hiding the original evidence.
Measure the system you actually use
Track representative task completion, incorrect claims, citation quality and human corrections. Include failure states such as provider outages and unreadable documents. An impressive demo on one example is not an evaluation of a working product. Document current limitations clearly, and revisit tests when the model, prompt, retrieval pipeline or data changes.
Try it yourself
Design a review checklist for an AI-generated report: source access, evidence links, unsupported claims, uncertainty, privacy and final approval. Try it on a fictional example.
What to look for
A report should be understandable and auditable without relying on trust in the model. Any unsupported conclusion should be removed, revised or explicitly marked as an inference.
Sources & further reading
Independent educational material. Examples are simplified and do not replace checking the documentation for the model or service you use.