IDEALIT Passport
Menu

Passport search

Find a mission or fix

Type at least two characters.

    Browse help by symptomBrowse all references
    How to start
    Curriculum previewThis is not your assigned passport. No identity, answers, or completion progress are stored here.How to start your passport
    Handbook / core

    core

    Data Classification And AI Tools

    Goal: decide what may be shared with GitHub, cloud services, and AI tools.

    View exact sourceReturn to my dashboard

    Goal: decide what may be shared with GitHub, cloud services, and AI tools.

    Prerequisites: know who owns the project's information and who can approve its use.

    Execution context: reading and scenarios only. Use fictional examples, not real confidential material.

    Classify Before Uploading#

    ETH uses four confidentiality levels: PUBLIC, INTERNAL, CONFIDENTIAL, and STRICTLY CONFIDENTIAL. Unless information has been approved for publication, do not assume it is public.

    The information owner decides the classification and approved systems. For a student project, that is normally your supervisor or the person responsible for the data.

    Example Default action
    Published documentation or public code May be used in approved workflows
    Internal lab procedure Keep within approved ETH/lab systems
    Unpublished results or manuscript Ask the information owner before external AI use
    Personal, contract-restricted, or partner data Use only explicitly approved systems
    Strictly confidential data Never upload to an external cloud or AI service

    Tool approval and data classification are separate questions. A tool that is convenient or covered by a personal subscription is not automatically approved for project data.

    Safe AI Workflow#

    1. Identify the data classification.
    2. Check the current ETH tool assessment and project rules.
    3. Minimize the context: provide only what is needed.
    4. Remove secrets, personal data, unpublished values, and unnecessary metadata.
    5. Ask the agent to state assumptions and verification steps.
    6. Review generated content for correctness, bias, licenses, and disclosure.
    7. Record AI assistance when project or academic rules require it.

    You remain responsible for AI-generated output. A model's confidence is not evidence.

    Control What An Agent Can Do#

    An IDE agent can read files, edit code, run terminal commands, use the network, or publish changes if those tools are enabled. Treat each capability as access you grant, not as a harmless chat feature.

    1. Begin with a read-only request when you need an explanation or plan.
    2. Name the files the agent may inspect and change, plus files it must not touch.
    3. Ask it to show the intended commands and verification before side effects.
    4. Prefer allow once for an understood command. Do not approve a broad "always allow" rule merely to dismiss a prompt.
    5. Review git diff, terminal output, tests, and any remote jobs yourself.
    6. Request commit, push, installation, network access, or Slurm submission only after their scope and cost are understood.

    Prompt text, repository instructions, or downloaded files can contain unsafe directions for an agent. A sandbox reduces the blast radius but does not make those directions correct. Stop if the agent asks for credentials, unrelated filesystem access, administrator rights, or a destructive recovery command. The mandatory boundary is defined in the Data and AI policy. Before configuring a coding agent, learn which component acts, which service receives context, and which account pays in Agents, models, providers, and interfaces.

    Scenario: Debugging Confidential Code#

    Do not paste the repository into a public chatbot. First ask the information owner which tools are approved. You may be able to reproduce the bug with a small fictional example that contains no protected implementation or data.

    Understand Before Accepting AI Output#

    • I can identify the information owner for my project.
    • I understand that unpublished research is not automatically public.
    • I can reduce a debugging example without exposing source data.
    • I grant agents only task-specific file and tool access.
    • I know that AI output needs technical and scholarly verification.

    Verification#

    Given a file or prompt, you should be able to state:

    1. its likely classification;
    2. who confirms that classification;
    3. whether the proposed tool is approved for it;
    4. what minimum context is actually needed.

    Common Failure And Safe Recovery#

    Protected material was entered into an unapproved AI service. Stop sharing, preserve the relevant service/account details without reposting the material, tell the information owner, and follow the incident procedure. Do not silently delete the conversation and assume the issue is resolved.

    Ask For Help When#

    The classification, project agreement, cloud assessment, license, or AI-use disclosure rule is unclear. Ask before uploading.

    Primary ETH Sources#

    Verified: 2026-08-04. Review by: 2026-11-04. Owner: IDEAL Lab IT maintainer with the project's information owner.