Template 03 of 8
Data-access and classification worksheet
List every data element the agent can read or write. Minimize before you approve.
Data inventory
| Data element | Source system | Classification | Legal basis | Read / write | Retention | Why needed |
|---|---|---|---|---|---|---|
| Example: course enrollment | SIS | Confidential | FERPA, legitimate educational interest | Read | Term + 1 year | Ground advising answers |
Checks
- Each element has a data owner who has approved its use
- Restricted data is excluded unless the tier and controls allow it
- Interaction logs are retained no longer than needed
- Vendor terms prohibit training on institutional data
- Prompt-injection and exfiltration risks are reviewed for write access