GovernmentAutessa AgentsAutessa Prism

How to Iterate Safely with AI: A Guide for Public Agencies

Experimentation is how agencies find the AI uses that help residents. Safe experimentation is what lets those uses survive a records request, an audit, or a front-page story.

By Roshnee Sharma · CEO, Autessa

The best AI work usually starts messy. Someone pastes a rough draft, a spreadsheet, or a tangled email thread into a chatbot, gets something useful back, and starts using it for more. That kind of experimentation is how teams find the uses that matter, and public agencies are now doing it at scale. California's state-managed AI platform, Poppy, went statewide this summer, and the state has announced AskCA, an assistant meant to guide residents to services based on what is happening in their lives.

People bring more than work to these tools. A survey reported by The Washington Post in September found that about a quarter of U.S. adults turn to AI for personal, emotional, or social questions, and close to 40 percent of that group has shared things with a chatbot they would not say to another person. When that habit meets a government account, a public records law, and a third-party model, "put everything in" stops being a harmless default.

This post covers three questions: where to draw the line on what goes into AI, how to protect sensitive data before it reaches an outside system, and why AI systems need something like crate training before they are ready for scale and scrutiny.

Three questions for safe AI iteration A messy start feeds into three sequential safeguards: drawing the line on what goes into AI, protecting data before it leaves the agency, and crate training a system before it scales. The result is an AI use that is ready for scrutiny. Messy start A draft pasted in 1 Draw the line What may go into an AI tool, and which account it belongs in. Records law Work vs. personal 2 Protect data Strip what is sensitive before it reaches an outside model. Redact in layers Every copy 3 Crate train Bound a system until it earns more freedom. Stage by stage Logged Ready for a records request, an audit, or a front-page story
Safe iteration is three habits in sequence, not a single approval gate. Decide what may go into a tool and which account it belongs in, strip what is sensitive before it reaches an outside model, and give a new system a bounded place to prove itself. The messy start is the point, and none of these steps require giving it up.

Where do you draw the line on what goes into AI?

A simple test works for most situations:

Would I be comfortable if this conversation were released in response to a public records request?

For public employees, that is not a hypothetical. It is the question records officers are starting to answer.

Courts and records offices do not agree yet

Agencies around the country have reached different conclusions about AI chat logs. The Texas Department of Transportation released employee ChatGPT conversations when asked. Colorado Springs refused to release its mayor's conversations, pointing to protections for work product and deliberations. Pennsylvania's Office of Open Records mostly sided with the governor's office in keeping employee logs private, treating them as personal notes and predecisional material, although media lawyers there note that a policy or press release produced with AI's help remains public.

That split tells you something important. There is no settled national answer, so every agency needs its own defensible approach.

How jurisdictions have treated AI chat logs Four jurisdictions reached different conclusions about whether employee AI conversations are public records: Texas DOT released them, Colorado Springs withheld them, Pennsylvania mostly withheld them as personal notes, and California has no AI-specific ruling yet. SAME QUESTION, DIFFERENT ANSWERS RELEASED Texas Department of Transportation Released employee ChatGPT conversations in response to a request. WITHHELD Colorado Springs Refused to release the mayor's logs, citing work product and deliberative protections. MOSTLY WITHHELD Pennsylvania OOR Treated logs as personal notes and predecisional material. Final products stay public. UNSETTLED California No AI-specific ruling. San Jose (2017) governs public business in personal accounts. No settled national answer, so each agency needs its own defensible position.
Four jurisdictions, four different answers to the same question about employee AI logs. Texas released them, Colorado Springs withheld them, and Pennsylvania treated them as personal notes while keeping final products public. Until a settled answer arrives, the defensible position is the one your agency has written down in advance.

California's starting point

In California, the key case is City of San Jose v. Superior Court (2017). The state Supreme Court ruled that communications about public business can be public records even when they live in an employee's personal account. By that logic, a council staff report drafted in someone's personal ChatGPT account could be reachable by a records request.

The same ruling also draws a boundary. A record has to be substantively about the public's business, so a conversation that brushes against work in passing usually is not one. And there is an unresolved question agencies should raise with counsel now, not after a request lands. The Public Records Act protects certain preliminary drafts and notes, but does a chat history that the tool saves automatically count as something kept in the ordinary course of business?

Mixing work and personal is the real risk

This is where the work account problem bites. If an employee uses an agency AI account to ask about a medical issue, a custody schedule, or a job search, that conversation now sits in a system governed by records law, retention schedules, and potential review. It may never be released, but someone may have to read it to decide.

The reverse is just as common. A 2025 survey by the security firm LayerX found that more than three-quarters of employees paste data into generative AI tools, and that the large majority of that activity happens in personal accounts their employer does not manage. For an agency, that means public business can end up in places the agency cannot search, secure, or retain properly.

The rule that follows is simple. Agency business goes in approved agency tools, personal matters stay out of them, and staff are told plainly why.

A practical sorting guide for what goes into AI Three columns sorting AI inputs: generally fine covers public information and brainstorming without identifying details; think twice covers internal drafts and deliberations in approved tools; keep it out covers resident personal information in unapproved tools, credentials, confidential case details, and personal matters in an agency account. Generally fine Public information General research Brainstorming with no identifying details Summarizing a document already released Think twice Internal drafts in an approved agency tool Deliberations, knowing they may be requested Aggregated data that could re-identify someone Anything headed for public-facing content Keep it out Residents' personal data in unapproved tools Credentials and keys Confidential case details Personal matters in an agency account Sealed or exempt records
Most inputs sort cleanly once staff have three buckets instead of a judgment call. The middle column is the one worth training on, because internal drafts in an approved tool are legitimate and may still be requested later.

How do you protect sensitive data before it leaves the building?

Sending data to a third-party AI model is not reckless on its own. Agencies already rely on outside vendors for email, storage, and case management. The difference with AI is that people paste in unstructured, context-rich material, and that material often contains exactly what should be protected: residents' personal details, investigation notes, procurement strategy, and internal deliberations.

California's approach with Poppy shows one answer. Put the safeguards in the platform instead of in each employee's memory. Poppy runs in an environment the state manages, flags personally identifiable information automatically, and keeps department data out of model training. Not every city or county can build that, but every agency can apply the same thinking.

Redact in layers

No single technique catches everything, so stack them.

Minimize first. Send the paragraph the task needs, not the whole case file. Data that never leaves cannot leak.

Detect with context, not just patterns. Rules that look for Social Security number formats will miss a name and street address written into an ordinary sentence. Detection needs to understand language well enough to catch those.

Use reversible placeholders. Instead of deleting details, swap them for consistent tokens so a resident's name becomes PERSON_1 and their address becomes ADDRESS_1. The model can still follow who is who, and the key that maps tokens back to real values never leaves the agency.

Check for re-identification. Removing a name is not enough if the prompt still includes a job title, a date, and a town of 900 people. Those details together can point to one person.

Confirm the redaction actually worked. Drawing a black rectangle over text in a PDF often leaves the underlying words fully searchable. Verify redactions in the file itself, not just on screen.

Redaction in five layers Raw agency material passes through five stacked filters before reaching an outside model: minimize, detect with context, pseudonymize with reversible tokens, check for re-identification, and verify the redaction held. The re-identification key stays inside the agency. INSIDE THE AGENCY Raw material Case file 1 Minimize Send only the lines the task needs 2 Detect Read for context, not just patterns 3 Tokenize Name to PERSON_1, reversibly and stably 4 Re-ID check Role plus date plus small town 5 Verify Confirm the text is gone from the file, not just hidden behind a box. To the model Re-identification key never leaves the agency
No single technique catches everything, so they stack. Minimizing shrinks what is exposed, contextual detection catches the identifiers a pattern match misses, and reversible tokens let the model follow who is who while the key that maps them back stays inside the agency. The last step is the one teams skip: confirming the text is actually gone from the file rather than hidden behind a black box.

Protect every copy, not just the first one

AI systems are good at making copies. One record can end up in a database, a search index, a conversation log, and a file store, each with separate permissions and retention settings. If a field is masked in one of those places but not the others, the sensitive data is still reachable. If it is deleted from one but not the rest, it is not really gone. The principle to adopt is that protections and retention rules follow the data wherever it goes.

Configure by program, and read the contract

Different programs carry different obligations, so settings should be applied per program or matter instead of relying on staff to remember which rules apply where. On the vendor side, get written answers about model training, retention periods, data location, and subprocessors.

You do not have to build this policy from scratch. California's Office of Data and Innovation has published a free data minimization toolkit covering the fundamentals, risk and necessity assessments, safe data sharing, and vendor contract review. The Department of General Services has already used it to update the state's standard confidentiality language for contracts, and local governments can use it today without waiting to be required to.

Why do AI systems need "crate training"?

Anyone who has raised a puppy knows the crate is not a punishment. It is a safe, bounded space where the dog learns the house rules and earns more freedom over time. Done well, you end up with a dog you can trust anywhere.

AI systems need the same treatment. A tool that starts as a helpful experiment can become a department workflow and then a public-facing service faster than anyone planned. When that happens, attention follows: executives, auditors, legislators, reporters, and residents filing records requests. The time to do the safety thinking is before that attention arrives.

Crate training an AI system across four stages An AI system earns scope in four stages: a pilot with a small group and low-sensitivity data, a department workflow, a cross-department rollout, and finally a public-facing service. Constraints, logging, and human review hold constant across every stage while the audience and scrutiny grow. SCOPE EARNED OVER TIME 1. Pilot Small group, low- sensitivity data Clearly a test 2. Department One workflow, real work, policies and training in place 3. Multi-department Deliberate pace. Poppy reached roughly 1,000 users across two dozen departments. 4. Public Residents, press, auditors, records requests CONSTANT AT EVERY STAGE Written constraints Training log Human decides Rollback and kill switch
Scope grows in defined stages, and the audience grows with it. What does not change is the rail along the bottom. Constraints, logging, human decision rights, and a way to shut the system off are in place from the pilot, because they are far harder to retrofit once residents and reporters are watching.

What it looks like in practice

Start in a small space. Pilot with a limited group, low-sensitivity data, and clear expectations that this is a test.

Expand in stages, on purpose. Poppy is a useful real-world example. About a month after its statewide launch, it had roughly 1,000 users across two dozen departments, and state officials described the pace as deliberate, leaving room for departments to put policies and training in place first. AskCA follows a similar path, with sign-ups opening before a pilot and state subject matter experts helping shape answers from verified sources.

Keep the rules consistent. Write down what the system is for, what it must never do, and what data it may touch, then build those rules into the configuration so they do not depend on who is using it that day.

Keep a training log. Every interaction worth keeping should record who asked, what they asked, which tool and model responded, what came back, and whether the output was used in an official action, tagged to the relevant program or matter. The National Archives' August 2026 guidance on AI records is written for federal agencies, but it is the most complete model available and treats inputs, outputs, audit trails, and even the software itself as potential records. A log like this is also what makes a future records request manageable.

Let AI propose and people decide. Records review is a good example. An agency export can contain thousands of conversations. AI can read all of them first and suggest whether each is work, personal, or mixed, noting possible exemptions and personal information. A records professional then makes every final call. Writing down each decision as it is made gives the agency the factual basis the San Jose court said should support any decision to withhold.

Plan for accidents. Have an incident process, a way to roll back changes, and a fast way to shut a system off.

Invite an outside check before the spotlight. In September, California enacted laws creating a framework for independent verification of AI systems and a state registry of AI auditors. Once that registry is running, agencies buying AI will have a practical option. They can require assessment by a registered auditor instead of relying on the vendor's own evaluation.

How do you keep safety from becoming the bottleneck?

Requests for new AI uses arrive constantly. If a review takes months for a low-risk idea, people will work around it, often in personal accounts, which recreates the records and security problems above. State technology leaders have been clear that the focus now is delivery, so governance has to keep pace.

A tiered intake process helps. Low-risk uses with public information in approved tools are pre-approved under published guidelines. Uses involving internal data or new integrations get a short checklist and quick sign-off. Anything touching residents' personal information, public-facing content, or decisions about people gets complete legal, security, and testing review.

Tiered intake for new AI requests A new AI request is routed by sensitivity into three lanes: a fast lane of pre-approved low-risk uses, a light review with a short checklist for internal data or new integrations, and a full legal, security, and testing review for anything touching residents' personal information or decisions about people. New request Sorted by sensitivity Fast lane Same day Public information in approved tools. Pre-approved under published guidelines. Light review Days Internal data or a new integration. Short checklist and a quick sign-off. Full review Weeks Residents' personal data, public-facing content, or decisions about people.
When every request takes months, people route around the process and land in personal accounts, which is the outcome the policy was meant to prevent. Sorting by sensitivity keeps the heavy review for the cases that earn it.

Just as important is a "paved road" of approved tools that are genuinely easy to use. Keeping agency business on agency channels is exactly what the San Jose court encouraged, and people choose the safe path far more often when it is also the convenient one. For smaller agencies, statewide cooperative contracts can make that paved road affordable.

A quick checklist

  • Agency business happens in approved AI tools.
  • Staff know agency AI conversations may be searched and released, and personal use is either prohibited or clearly explained.
  • Counsel has weighed in on how drafts and saved chat histories are treated under the Public Records Act.
  • Self-search attestation forms mention AI tools alongside email and texts.
  • Redaction happens in layers: minimize, detect, pseudonymize, check for re-identification, verify.
  • Protections and retention rules apply to every copy of the data.
  • Vendor terms on training, retention, location, and subprocessors are documented.
  • AI interactions are logged with enough detail to answer a records request.
  • A retention schedule covers AI conversations.
  • New systems start small and expand in defined stages.
  • AI-assisted public content is labeled as such.
  • Low-risk requests have a fast path.

The bottom line

Experimentation is how agencies will find the AI uses that actually help residents. Safe experimentation is what lets those uses survive a records request, an audit, or a front-page story. Draw clear lines around what goes into AI and where, strip sensitive data before it leaves your environment, and give every new system a bounded place to prove itself before it is handed more responsibility. You do not have to choose between moving quickly and being ready for scrutiny.

This is the problem Autessa was built for. Agencies get a managed environment where redaction, logging, retention, and human review are properties of the platform rather than habits each employee has to remember. That is what makes it possible to let people experiment and still answer for every conversation later.

This post is general information, not legal advice. Records, privacy, and retention obligations vary by agency and jurisdiction, so set your policies with your own counsel.

Sources