A document can identify someone without naming them
Imagine a consultant asking an AI assistant to summarise a dispute. They remove the client's name but leave the employer, town, exact date and an unusual sequence of events. A colleague familiar with the case could still recognise it. Replacing names and email addresses would not resolve that problem.
Before using a document, decide which facts the task actually needs. If the goal is to improve the wording of an email, a short fictional example may be enough. If the task needs the full case, use the review process your organisation has agreed for that information and service.
Give people an example they can follow
An instruction such as 'do not share confidential data' leaves the difficult decision to the person who is already trying to finish a task. Show a fictional before-and-after example instead. Mark which details were removed, which were generalised and which made the document unsuitable for the proposed use.
Keep the guidance near the workflow: which assistant is approved for this task, who can answer a question, and what to do when the document cannot be reduced safely. An employee should have a workable next step after a blocked submission.
Use detection as one part of the check
A detector can help find configured patterns such as email addresses or an internal project name. It cannot reliably decide whether a combination of ordinary facts identifies a client, or whether a particular use has been approved. Those decisions need context the rule may not have.
Test technical controls with fictional documents representative of your work. Include an ordinary document that should pass and one containing a phrase the policy should catch. Separately review the handling decision with the person responsible for client information. A document passing a scan is not approval to share it.