PRODUCTION SCENARIO
A consumer language-tutoring app on the OpenAI API serves 200,000 end users and wants OpenAI's abuse monitoring to single out one bad actor rather than throttle the whole organization. Its privacy policy bars sending user emails to processors beyond what is needed.
What should each request carry to identify the end user?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: A safety_identifier set to a one-way hash of the user's account ID or email
A safety identifier should be a string that uniquely identifies each user, hashed from the username or email address so no identifying information is sent, with a session ID standing in for users who are not logged in. One shared identifier per organization cannot distinguish the individual abuser, and abuse monitoring reads the safety_identifier field rather than transport metadata.