# `semantic.ai_personal_data_not_allowed`

Personal data reaches a model in a category `ai: { personal_data: { allowed: } }` doesn't list.

Area 21, [AI](../topics/ai.md); not declinable; the next step is usually the human's.

Each personal-data category a prompt or an embedded text sends the model
is listed in `ai: { personal_data: { allowed: } }`, so what the
provider is given is decided once, in `app.jadpo`, where a reviewer sees
it; `personal_data:` left out allows none. The compiler follows each
placeholder back to the fields it was read or built from, so a marked
field copied into a variable, built into text or passed through a
function keeps its category, and a standard type that is personal data
whatever holds it (an `NhsNumber`, a `ChatMessage`) is its own. The
problem names the field and the category, never a value. Here the
clinic lists `identifying` but sends `health`:

```jadpo
application {
    connections: {
        local_model: {
            driver: Driver.openai_compatible
            url: config.model_url
        }
    }
    ai: {
        connection: local_model
        models: {
            default: config.drafting_model
        }
        limits: {
            per_day: {
                tokens: 2000000
            }
        }
        personal_data: {
            allowed: [PersonalData.identifying]
        }
    }
}
```








```jadpo
use clinic/entities { Patient, PatientNotFound }
use clinic/types { ClinicalNote, HandoverSummary }
use clinic/failures { SummaryUnavailable }
use clinic/prompts { SummariseNotes }

/// Summarises a patient's notes for the clinician taking over.
action hand_over(
    patient_id: Patient.id
) fails PatientNotFound, SummaryUnavailable -> HandoverSummary {
    var patient: Patient = attempt Patient.get(patient_id)
    var handover_notes: ClinicalNote = patient.notes
    return attempt ai.generate(
        SummariseNotes {
            notes: handover_notes
        },
        as: HandoverSummary
    ) {
        refused: SummaryUnavailable
        malformed: SummaryUnavailable
        timed_out: SummaryUnavailable
        over_budget: SummaryUnavailable
        too_long: SummaryUnavailable
    }
}
```

```text
error: `Patient.notes` reaches a model, and `ai:` doesn't allow `health` data
 --> domains/clinic/actions/hand_over.jadpo:14:20
   |
14 |             notes: handover_notes
   |                    ^^^^^^^^^^^^^^ holds `Patient.notes`
  reason: `SummariseNotes`'s `{notes}` is built from `Patient.notes`, marked `personal: PersonalData.health`, a sensitive category. Each personal-data category sent to a model is listed in `ai: { personal_data: { allowed: } }`, so what the provider is given is decided in `app.jadpo`, where a reviewer sees it.
  next: List `PersonalData.health` in `ai: { personal_data: { allowed: } }`, or leave `Patient.notes` out of `SummariseNotes`'s `{notes}` (human)
  rule: semantic.ai_personal_data_not_allowed
  help: https://jadpo.dev/docs/errors/semantic.ai_personal_data_not_allowed

check failed: 1 error, 8 files
```