1
00:00:00,900 --> 00:00:04,940
Before you hand an agent a file,
stop and ask where it's going.

2
00:00:06,360 --> 00:00:12,065
Three questions: where does it go, does
it belong there, and whose rules apply?

3
00:00:14,800 --> 00:00:17,748
AI for Research Efficiency.

4
00:00:17,798 --> 00:00:21,707
Episode 9: Your data,
your keys, your campus.

5
00:00:24,300 --> 00:00:28,125
Last time, many agents at once:
several terminals,

6
00:00:28,196 --> 00:00:30,378
or one agent that splits the work.

7
00:00:31,163 --> 00:00:35,608
This time, the rules around all of
them, with a checklist at the end.

8
00:00:38,900 --> 00:00:41,911
One: your plan decides where it goes.

9
00:00:42,811 --> 00:00:46,025
Whatever the agent reads goes
to the company that runs the model,

10
00:00:46,176 --> 00:00:47,701
along with your request.

11
00:00:49,222 --> 00:00:52,452
On a personal plan, it may be used
to train future models,

12
00:00:52,563 --> 00:00:54,427
unless you switch that setting off.

13
00:00:55,641 --> 00:01:00,665
On a work, school or API plan, it
isn't used for training by default.

14
00:01:02,254 --> 00:01:06,202
So check which plan you're on,
and its setting, before you start.

15
00:01:10,100 --> 00:01:12,571
Two: what never goes in.

16
00:01:13,295 --> 00:01:18,583
Student records, health data, study
participants' data under an IRB protocol,

17
00:01:19,054 --> 00:01:22,900
export-controlled work,
and other people's unpublished work.

18
00:01:24,140 --> 00:01:25,566
None of it goes to an agent,

19
00:01:25,738 --> 00:01:28,832
unless your campus has approved
that tool for that data.

20
00:01:30,742 --> 00:01:34,813
At the University of Arkansas, for
example, data comes in four classes:

21
00:01:35,185 --> 00:01:39,276
restricted, highly sensitive,
sensitive, and public.

22
00:01:40,816 --> 00:01:41,458
Restricted

23
00:01:41,508 --> 00:01:45,592
and highly sensitive data may only
go into tools the university licenses

24
00:01:45,642 --> 00:01:47,005
or approves for it.

25
00:01:50,900 --> 00:01:52,656
Three: keys.

26
00:01:53,477 --> 00:01:57,923
A key is a password your scripts use,
and some keys can spend money.

27
00:01:59,047 --> 00:02:01,253
Put it in a file named .env,

28
00:02:01,665 --> 00:02:06,398
and list that file in .gitignore,
so it never reaches a repository.

29
00:02:08,718 --> 00:02:12,226
Then give the agent the key's name,
never its value.

30
00:02:12,617 --> 00:02:16,524
A pasted key goes to the vendor,
and stays in the session's history.

31
00:02:18,068 --> 00:02:21,193
Without a rule,
an agent reads the file when you ask.

32
00:02:21,665 --> 00:02:24,850
Here, Codex prints the
value into the conversation.

33
00:02:27,135 --> 00:02:29,677
So write the rule into
your instruction file:

34
00:02:30,127 --> 00:02:32,359
never read or print .env.

35
00:02:33,050 --> 00:02:35,752
Claude Code can enforce it
with a deny rule.

36
00:02:39,492 --> 00:02:42,414
Codex can deny the file
in a permission profile.

37
00:02:42,945 --> 00:02:48,128
Antigravity's sandbox is meant to block
it; in our test, it read the file anyway.

38
00:02:49,848 --> 00:02:53,853
Give each project its own key,
with only the access it needs.

39
00:02:54,224 --> 00:02:56,667
If one leaks, revoke it first.

40
00:03:00,500 --> 00:03:02,936
Four: someone else's work.

41
00:03:03,756 --> 00:03:06,942
If you review grant proposals,
the funders have spoken.

42
00:03:07,453 --> 00:03:08,384
At NIH,

43
00:03:08,495 --> 00:03:11,931
reviewers are prohibited
from using AI tools in analyzing

44
00:03:11,981 --> 00:03:16,609
and critiquing NIH grant applications
and R&D contract proposals.

45
00:03:17,970 --> 00:03:22,217
NSF reviewers are prohibited from
uploading any content from proposals,

46
00:03:22,307 --> 00:03:27,455
review information and related records
to non-approved generative AI tools.

47
00:03:29,080 --> 00:03:31,431
A journal's peer review
has rules of its own.

48
00:03:31,823 --> 00:03:34,213
Read them before you
open the manuscript.

49
00:03:36,500 --> 00:03:39,476
Five: find your campus's rules.

50
00:03:40,316 --> 00:03:41,978
At the University of Arkansas,

51
00:03:42,269 --> 00:03:47,055
any AI tool used for university
business must be vetted and approved.

52
00:03:48,415 --> 00:03:50,696
Its approved list names chat tools.

53
00:03:51,187 --> 00:03:55,079
On 4 October, none of the three
agents in this series was on it;

54
00:03:55,389 --> 00:03:58,231
for those,
there's a tool exception request.

55
00:03:59,994 --> 00:04:01,837
Your campus will have its own list.

56
00:04:02,208 --> 00:04:07,298
Search its website for approved AI
tools, or ask its IT security office.

57
00:04:10,100 --> 00:04:12,067
Pause here, and check two things:

58
00:04:12,398 --> 00:04:16,271
your tool's training setting,
and your campus's approved list.

59
00:04:19,700 --> 00:04:23,127
So: check your plan,
keep protected data out,

60
00:04:23,478 --> 00:04:25,292
keep keys in .env,

61
00:04:25,964 --> 00:04:29,591
keep reviews out,
and find your campus's list.

62
00:04:33,900 --> 00:04:38,020
Next: research APIs,
a ladder of keys.