semantic.ai_personal_data_not_allowed

Your code sends a model personal data of a kind, such as health records, that the app's ai: settings don't allow it to send.

Area 21, AI; not declinable; the next step is usually the human's.

Why Jadpo refuses it

By default your app may send a model no personal data at all. Each kind it sends, its category, is listed once in app.jadpo, under ai: { personal_data: { allowed: } }, so a reviewer sees in one place what the provider is given. A field's category comes from its personal: mark, or from a standard type that is always personal data, such as an NhsNumber.

The compiler follows each value a prompt is built from back to the fields it was read from. A marked field copied into a variable, built into text or passed through a function keeps its category. The error names the field and the category, never a value.

Jadpo won't list a category for you. Sending health records to a provider is a privacy decision, and it is yours.

What it looks like

The clinic allows identifying data, and its handover summary sends a patient's notes, which are health, through a variable.

app.jadpo:

application {    connections: {        local_model: {            driver: Driver.openai_compatible            url: config.model_url        }    }    ai: {        connection: local_model        models: {            default: config.drafting_model        }        limits: {            per_day: {                tokens: 2000000            }        }        personal_data: {            allowed: [PersonalData.identifying]        }    }}

domains/clinic/entities/patient.jadpo:

use clinic/types { ClinicalNote }/// A patient of the clinic.entity Patient {    id: Uuid    patient_nhs_number: NhsNumber {        personal: PersonalData.government_id        to_models: false    }    notes: ClinicalNote {        personal: PersonalData.health    }    person: true}

domains/clinic/actions/hand_over.jadpo:

use clinic/entities { Patient, PatientNotFound }use clinic/types { ClinicalNote, HandoverSummary }use clinic/failures { SummaryUnavailable }use clinic/prompts { SummariseNotes }/// Summarises a patient's notes for the clinician taking over.action hand_over(    patient_id: Patient.id) fails PatientNotFound, SummaryUnavailable -> HandoverSummary {    var patient: Patient = attempt Patient.get(patient_id)    var handover_notes: ClinicalNote = patient.notes    return attempt ai.generate(        SummariseNotes {            notes: handover_notes        },        as: HandoverSummary    ) {        refused: SummaryUnavailable        malformed: SummaryUnavailable        timed_out: SummaryUnavailable        over_budget: SummaryUnavailable        too_long: SummaryUnavailable    }}

   |14 |             notes: handover_notes   |                    ^^^^^^^^^^^^^^ holds `Patient.notes`

(human) at the end of the next: line tells your coding agent to stop and ask you which fix you want, because the choice is yours to make: it decides whether the model's provider is given patients' health records.

How to fix it

The question is whether the provider may be given this kind of data.

If it may, list the category in app.jadpo:

            allowed: [PersonalData.identifying, PersonalData.health]

The handover summary now sends each patient's notes to the model, and app.jadpo says so where a reviewer reads it. Any other prompt that sends health data is allowed too, since the list is for the whole app.

If it may not, build the prompt only from fields whose categories are listed, and leave Patient.notes out of it. The NHS number is never sent either way, since its field is marked to_models: false.

Related

• Personal data sent to a model
• Following personal data
• Marking personal fields
• semantic.ai_field_refused