AI agent accesses EU data
Your company serves EU customers and has a contractual commitment that personal data stays in the EU. An engineer wants to enable an AI coding agent that, to fix bugs, can read application logs and run queries against a staging database that contains pseudonymized-but-real EU user records. The agent's inference endpoint is hosted in us-east. How do you reason about whether this is allowed, and what guardrails would you require before turning it on?
screen_agent_data_flow(data_classes: list[str], endpoint_regions: list[str], zero_retention_terms: list[bool]) → list[str][["pseudonymized","anonymized"],["us-east-1","us-east-1"],[true,false]]out["deny:cross_border_transfer","allow"][["personal","personal"],["eu-west-1","eu-west-1"],[true,false]]out["allow","deny:no_zero_retention"]Treat the AI’s output as a draft to verify, not an answer to trust. Name the specific flaw and the input that triggers it, say how you’d catch it (tests, edge cases, reading critically), and how you’d re-prompt or decompose to get it right.
Vibe & agentic: describe the solution in plain language (or narrate it) and the coach grades your approach.