A housing authority needs case narratives for quality evaluation of a summarizer. Which data control best enables safer evaluation?

Housing-authority case narratives used to evaluate a summarizer still contain tenant-sensitive details. Anonymizing those narratives for quality evaluation preserves enough structure for reviewers to score faithfulness, completeness, and tone while removing direct identifiers that create privacy exposure. Encrypting case narratives used for quality evaluation of the summarizer protects data at rest but leaves tenant identifiers visible to anyone with decryption access during scoring, so it does not remove the privacy exposure that anonymization addresses. Restricting workspace access to case narratives for the summarizer evaluation controls who can enter the workspace but does not de-identify the narratives, so reviewers can still see tenant-sensitive details while scoring. Logging reviewer activity on case narratives for the summarizer evaluation creates an after-the-fact trail but does nothing to mask tenant identifiers from reviewers while they evaluate the summarizer. Exam caveat: evaluation datasets for civic AI inherit the sensitivity of source case data and require privacy controls proportionate to production data, not a free pass because they are labeled “just for QA.” Operational check: produce an anonymized housing eval set with reviewed re-identification risk, restrict access to scorers, ban personal-account transfers, and verify that evaluation artifacts cannot reconstruct tenant identity from remaining fields.