Transit wants AI analytics on operations logs that include badge identifiers. What data control should management require first?

Transit operations logs that include badge identifiers link AI analytics to individual workers. Tokenizing badge IDs from logs before any AI analytics job runs still feeds linkable pseudonyms into the analytics layer, creating privacy, labor-relations, and misuse risks that outweigh any convenience of easier joins. Management should require redaction of badge IDs before AI analytics jobs run so analysis focuses on operational patterns—delays, incidents, asset utilization—without unnecessary personal tracking. Allowing analytics jobs to use tokenized IDs prioritizes join convenience over data protection and normalizes surveillance-grade datasets across the transit analytics estate. Encrypting badge IDs from logs before any AI analytics job runs still leaves identifiers recoverable with the key and linkable for tracking, so processing still exposes employees to targeting or harassment. Hashing badge IDs from logs before any AI analytics job runs still creates a consistent fingerprint that lets analytics link every event to the same worker and can often be reversed by dictionary attack, leaving a trail that is hard to purge and easy to leak. Exam caveat: identifier masking before AI processing is a primary data-management control when analytics do not require identity. Operational check: implement a transit log pipeline that strips or tokens badge fields pre-analytics, test that jobs fail closed if raw IDs appear, and document any rare exception that truly needs identity with purpose, retention, and access justification.