LLM-Powered Data Assistant: Risk & Guardrail Checklist

{"Title":"LLM-Powered Data Assistant: Risk & Guardrail Checklist","IntroductionHtml":"

Use this checklist to evaluate safety, privacy, governance, and operational controls before deploying a conversational LLM assistant that accesses analytics or operational data. Save the completed checklist as evidence for audits and approvals. Adapt items to your environment and add organization-specific controls where needed.

","SubmitLabel":"Save checklist","SuccessMessage":"Checklist saved to the project record.","DataType":"llm-data-assistant-checklist","SchemaVersion":"1.0","Fields":[{"Key":"owner","FieldType":"text","Label":"Checklist owner (name & role)","HelpText":"Person responsible for completing this checklist","Required":true},{"Key":"date","FieldType":"text","Label":"Date","HelpText":"YYYY-MM-DD","Required":true},{"Key":"data_access_controls","FieldType":"checkbox","Label":"Data & Access Controls — Confirm these controls are in place","Options":[{"Value":"encryption_at_rest","Label":"Data encrypted at rest and in transit"},{"Value":"least_privilege","Label":"Least-privilege access enforced for model and services"},{"Value":"tokenization_pseudonymization","Label":"Sensitive fields tokenized or pseudonymized"},{"Value":"row_level_filters","Label":"Row-level or tenant filters applied where needed"},{"Value":"no_raw_pii_to_model","Label":"Raw PII or credentials not sent to model"}]},{"Key":"prompt_injection","FieldType":"checkbox","Label":"Prompt & Injection Protections — Confirm these protections","Options":[{"Value":"input_sanitization","Label":"Inputs sanitized and validated"},{"Value":"context_size_limits","Label":"Context window limits set to prevent unintended context leakage"},{"Value":"response_whitelisting","Label":"System prompts and response templates are controlled/whitelisted"},{"Value":"untrusted_content_handling","Label":"Handling for user-supplied documents is defined"},{"Value":"meta_input_separation","Label":"User data separated from system prompts and secrets"}]},{"Key":"output_quality","FieldType":"checkbox","Label":"Output Quality & Hallucination Mitigation — Confirm these measures","Options":[{"Value":"grounding_required","Label":"Model requires grounding sources for factual claims"},{"Value":"citation_policy","Label":"Provenance and citation policy enforced"},{"Value":"confidence_thresholds","Label":"Confidence thresholds and human review for critical outputs"},{"Value":"tool_use_controls","Label":"External tool and DB calls validated and rate-limited"},{"Value":"answer_format_constraints","Label":"Structured answer formats or templates to reduce ambiguity"}]},{"Key":"provenance_audit","FieldType":"checkbox","Label":"Provenance, Logging & Auditing — Confirm these are enabled","Options":[{"Value":"full_request_logging","Label":"Full request and response logging (redacted where appropriate)"},{"Value":"model_versioning","Label":"Model and prompt versioning recorded"},{"Value":"data_source_links","Label":"Responses include links or IDs to source records when possible"},{"Value":"access_audit_trails","Label":"Access and query audit trails enabled"},{"Value":"retention_policy","Label":"Log retention and deletion policy defined"}]},{"Key":"privacy_compliance","FieldType":"checkbox","Label":"Privacy & Compliance — Confirm compliance controls","Options":[{"Value":"datarisk_assessment","Label":"Data protection impact assessment completed"},{"Value":"data_locality","Label":"Data residency/locality requirements observed"},{"Value":"consent_handling","Label":"Consent and opt-out mechanisms implemented"},{"Value":"regulatory_controls","Label":"Regulatory constraints (HIPAA, GDPR, etc.) mapped"}]},{"Key":"monitoring_ops","FieldType":"checkbox","Label":"Monitoring & Operational Controls — Define monitoring signals","Options":[{"Value":"error_rate_alerts","Label":"Error / failure rate alerts configured"},{"Value":"nonsense_detection","Label":"Nonsensical / off-topic response detection in place"},{"Value":"bias_metrics","Label":"Bias/fairness indicators monitored"},{"Value":"usage_anomalies","Label":"Usage anomaly detection and rate limits enforced"},{"Value":"performance_alerts","Label":"Latency and throughput monitoring enabled"}]},{"Key":"thresholds","FieldType":"number","Label":"Critical alert threshold (%) — e.g., % of responses flagged to trigger review","HelpText":"Enter a percentage (e.g., 1 for 1%)","Required":false},{"Key":"human_in_loop","FieldType":"radio","Label":"Human-in-the-loop for critical outputs?","Options":[{"Value":"yes","Label":"Yes — human approval required"},{"Value":"no","Label":"No — automated only"},{"Value":"conditional","Label":"Conditional — based on risk/thresholds"}],"Required":true},{"Key":"sensitive_workflows","FieldType":"checkbox","Label":"Sensitive workflows — Does this assistant touch any of these?","Options":[{"Value":"financial_decisions","Label":"Financial decisions or recommendations"},{"Value":"clinical_advice","Label":"Clinical or health-related guidance"},{"Value":"legal_advice","Label":"Legal advice or contract generation"},{"Value":"safety_critical","Label":"Safety-critical operations or instructions"},{"Value":"personnel_actions","Label":"Hiring, firing, disciplinary recommendations"}]},{"Key":"mitigation_plan","FieldType":"textarea","Label":"Mitigation plan for identified risks","HelpText":"Describe steps, owners and timeline"},{"Key":"test_plan_summary","FieldType":"textarea","Label":"Experiment & Test Plan Summary","HelpText":"Describe hypothesis, evaluation metrics, sample data and acceptance criteria"},{"Key":"pilot_results","FieldType":"textarea","Label":"Pilot results & key observations","HelpText":"Summarize pilot findings and any incidents"},{"Key":"final_decision","FieldType":"radio","Label":"Deployment decision","Options":[{"Value":"approved","Label":"Approved for production"},{"Value":"conditional","Label":"Approved with conditions (list below)"},{"Value":"rejected","Label":"Rejected — not ready"}],"Required":true},{"Key":"approval_conditions","FieldType":"textarea","Label":"Conditions for approval (if any)"},{"Key":"approver_name","FieldType":"text","Label":"Approver name & role"},{"Key":"approver_signature","FieldType":"text","Label":"Approver signature (or electronic ID)"},{"Key":"approver_date","FieldType":"text","Label":"Approval date (YYYY-MM-DD)"},{"Key":"notes","FieldType":"textarea","Label":"Additional notes or links","HelpText":"Link to related docs, dashboards, tickets"}]}