Claude Duet and privacy: permissions, memory and business data

To assess Claude Duet and privacy, separate source access, retained context and authorisation to act. Make these three decisions explicit before entrusting business data to an assistant. Start with a small task, the necessary information, an accountable person and a result that can be checked.

As of 22 October 2026, the preview is available only in the United States, for Pro/Max subscribers by invitation. For an overview of the product, refer to the introductory guide to Claude Duet and to official operational documentation. Here we design controls for assessing an agent: we are not describing activation in Italy or a test conducted by Giallo.

Which data does the task actually need?

"Help me with work" does not establish which information is necessary. "Prepare an internal brief for this meeting using the agenda and authorised notes" defines a scope. First write the question that the result must answer. Then work back to the documents needed, rather than starting with the full list of apps you could connect.

For each source, ask what would change if you removed it. If a draft agenda remains useful without the order history, that history can stay outside the first experiment. If knowing that a calendar slot is occupied is enough, describing its contents may be unnecessary. Minimisation becomes practical when you remove fields and attachments, rather than merely adding a sentence about caution.

Prepare a sanitised or synthetic sample and check the result. Do not assume that a label, folder or instruction technically restricts a connector: verify that capability in the available interface. If access remains broader than necessary, stopping that connection and rethinking the input is a sensible design choice. The same principle applies to an AI knowledge base with permissions.

How do you distinguish data access, use and output?

Access determines which resources can be reached. The delegation describes the permitted task. Output concerns what the result may communicate or change. A small business can document these decisions on one page, with a row for each source: a concrete rule is easier to correct than a general request for confidentiality.

This table proposes a way to organise work; it does not describe Duet's menus. It helps reveal misunderstandings before connecting accounts. A salesperson may be entitled to consult a document without being the person who authorises sending it. An assistant can receive an extract to prepare a summary without needing the entire archive in its working context.

The corporate policy on the use of AI should make these responsibilities clear. Avoid phrases such as "the owner authorised the AI" when several people use different sources and outputs. Specify who approves the connection, who maintains the material and who reviews any action. Even if one person fills every role, the distinction is useful for remembering the steps.

Why does disconnecting an app not close the task by itself?

The documentation makes clear that disconnecting an app stops future access without deleting previous memory. Claude Duet Help Center. This distinction changes how you prepare to end a trial: the review must cover several elements, each checked separately.

Draw a simple map: original source, conversations or context used, outputs produced and any internal copies. Do not assume that an operation on one item affects the others. A revoked connection, a remembered note and an exported document are different items in your inventory. Where the service offers relevant settings, examine the current options and record what you verified.

The useful question is "which information should no longer be available, and where might it be?" If a sales contact changes, you may need to update an outdated contact in the working context. When a project ends, review the information associated with it. Do not use a general confirmation of deletion from the model as the sole evidence of an administrative operation.

Open the checklist for closing a trial

• List connections, accounts involved and responsible people.
• Verify that access no longer needed has been revoked.
• Check the options for retained context separately.
• Identify copies and outputs distributed across business systems.
• Record verified operations, unresolved items and the owner of each.
• Keep only the documentation needed to explain the closure.

What should you check in the consumer terms?

The consumer policy allows model improvement with consent; raw connector data is treated differently if copied into a conversation. This is not a policy dedicated to Duet. Official information on training.

For a business assessment, this means reading the terms that apply to the actual account. Remembering a sentence from another plan's presentation is not enough. Keep the reference and the date you checked it; note any questions the documentation does not resolve for your case. Settings, contractual terms and operational behaviour are separate checks.

The sources considered here are insufficient to establish a Duet-specific DPA, EU data residency or GDPR compliance for your use. Retention and dedicated terms remain matters to verify before appropriate business use. This is a limitation of the documentation available, not a conclusion about the outcome of a legal assessment. The guide to Claude for companies helps frame the organisational questions without automatically transferring terms between plans.

How do you recognise a hostile instruction inside a source?

An incoming message is material to analyse. It may also contain instructions that try to change the assistant's task. When designing the process, distinguish what the responsible person requested from what an external source would like to have done. The risk increases when content that is read can influence a later action.

Hypothetical scenario one: an email from a fake supplier. In our invented example, the message asks for the internal customer list to be attached to a reply, presenting this as an urgent verification. The business had assigned only a summary of an availability enquiry. The additional attachment is unnecessary for that summary, and the sender cannot extend the delegation.

The proposed control is to interrupt the move from information to action. The review brief must flag the additional request and show its origin; no list is prepared for external sharing as an implicit consequence of reading it. This scenario does not demonstrate Duet's actual behaviour, and a written rule does not eliminate the problem. It provides a test case for checking whether the business process distinguishes sources from authorisations.

To explore the boundary between external content and available tools, read about network access and security for Claude Managed Agents. The issue matters even without delegating sending: hostile text can contaminate a summary, alter a priority or hide information the reviewer needed to see.

What should a useful approval request show?

The reviewer needs the concrete proposal, not merely a reassuring summary. For a communication, prepare the final text, full recipient details, attachments and purpose. For an internal change, identify the item, the intended change and the source that justifies it. The review must make errors detectable without reopening the project's entire history.

Check the relationship between the data and the wording too. "To be confirmed" cannot become a promise; an internal note does not automatically become shareable material. When a result combines several sources, make clear which one supports a figure or condition. Plausible information without a reference must remain an open question.

The organisational issue resembles the one described for email permissions and approvals with Dots, without assuming identical controls across products. A transferable procedure describes what a person must verify. Its technical implementation requires examining the chosen service's functions. For the differences between Claude experiences, see the Duet, Cowork and Code comparison.

How can you test minimisation in a working day?

Hypothetical scenario two: a small agency prepares for a meeting. The responsible person wants an internal brief covering objectives, questions and missing documents. This is an invented example, not a Giallo client. The initial sample contains a concise agenda and sanitised notes, without the full archive of sales conversations.

The trial should answer three questions: does the brief help with preparation, distinguish facts from uncertainties, and avoid irrelevant information? If a note is missing, the result should identify the gap. Adding the whole mailbox immediately would make it harder to understand which data improved preparation. Expand the sample only after identifying a specific need.

The responsible person compares the brief with the sources and records attribution errors, omissions and unnecessary content. The next sample changes one element at a time. This assesses the process without attributing measured performance or unobserved financial results to the product. The guide to Claude Duet with Gmail and Google Calendar explores how to design an assisted working day.

How can you prevent a summary from disclosing unnecessary information?

Minimisation also applies to the result. An authorised source may contain details that the brief's recipient does not need to do their job. Before the trial, describe the output's audience: owner, project team or external contact. The same summary is not necessarily appropriate for everyone.

Consider a preparatory note that mixes meeting objectives with internal assessments. An output for a colleague might need only the objectives. The trial should check whether the brief maintains that distinction, without filling up with irrelevant details merely because they appear in the input. Do not automatically add extensive quotations or complete attachments to make the proposal appear better documented.

Give the reviewer two separate checks: fidelity to the sources and relevance to the recipient. A statement can be true yet unnecessary. If you remove it, is the decision still understandable? If so, you have a concrete candidate for exclusion. If it is needed to justify a choice, consider whether an internal reference accessible to the authorised person would suffice.

Check the document name and delivery channel too. A correctly prepared brief can end up in the wrong folder or be forwarded with irrelevant material. The process should specify where the result is stored and who may distribute it. Reviewing the generated text alone does not resolve that decision.

To make the check repeatable, add a source containing a detail irrelevant to the task. Use a synthetic example chosen specifically to observe information selection. If the detail reappears, correct the scope and requested format before using more extensive material. The trial does not certify the absence of disclosures: it reveals concrete behaviour and helps you decide whether the project is ready for the next step.

What should you document before expanding the trial?

Close the first experiment with a page a colleague can understand: task, sources, exclusions, reviewer, observed results and unresolved issues. Add the closure procedure and the person who carries it out. If the project depends on an unverified condition, label it as such before increasing the volume of data.

The next step might be another trial with a different sample, or a revision of the input. It does not have to mean more connections. The choice between personal assistance and a structured process is explored in the guide to proactive AI agents for SMEs.

To turn these controls into a concrete business experiment, start with a sanitised example document and the desired result. With Giallo AI Agent Design you can define sources, responsibilities and verification criteria before introducing connections to your systems. Let's discuss the process you want to simplify.