PRODUCTION SCENARIO
An internal assistant calls an external vendor that needs only an opaque case ID and a status string. The internal record it reads also carries customer names and private case notes that must not be transmitted.
Which control directly enforces the allowed outgoing fields?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: Build the outbound payload from an allowlist of the permitted vendor fields
Building the payload from a named list of properties is what makes an unexpected field impossible to send, and the same guidance rejects generic to_json-style serialisation for this reason. A prompt shapes text and does not gate a field. Tokenising the name still ships the private notes and more than the two fields the vendor needs. A contract and an outbound log are governance and forensics, both after the bytes have left.