--- title: Respecting your users' dread of the clankers | daily.dev description: An opinion piece argues that AI products should respect users who are skeptical or fearful of AI by giving them granular, progressive opt-in control rather... canonical: https://daily.dev/posts/respecting-your-users-dread-of-the-clankers-mypza4yrj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Respecting your users' dread of the clankers | daily.dev og:description: An opinion piece argues that AI products should respect users who are skeptical or fearful of AI by giving them granular, progressive opt-in control rather... og:url: https://daily.dev/posts/respecting-your-users-dread-of-the-clankers-mypza4yrj og:image: https://api.daily.dev/og/posts/MyPZa4YRj.png og:image:alt: Respecting your users' dread of the clankers og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Respecting your users' dread of the clankers **[thoughbot](https://daily.dev/sources/thoughbot)** · 7 min read · 0 upvotes · 0 comments ## Summary An opinion piece argues that AI products should respect users who are skeptical or fearful of AI by giving them granular, progressive opt-in control rather than blanket consent. It recommends just-in-time consent patterns borrowed from mobile permission requests, pre-approval checklists for specific AI use cases (like sharing health data or booking appointments), clawback mechanisms to revoke access and purge cached data, and techniques for agents to detect and reject PII or secrets (system prompts, regex detection in-browser, and thoughtbot's open-source top_secret Ruby gem for server-side detection). It frames these ideas as an extension of early-2000s data privacy movements applied to LLM-era products. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How should an app ask users for permission to let an AI agent access their personal data? Use progressive, just-in-time consent rather than a single blanket checkbox at signup. Wait until the agent can demonstrate value, then ask contextually, such as offering AI help when a user is stuck on a form. Break permissions into granular categories, like allowing an agent to book appointments versus sharing radiology images with AI, and let users revoke access later, including clearing prompt caches and sanitizing conversation histories. _Developers designing AI consent flows can find more implementation patterns and discussion on daily.dev._ ### How can an AI agent avoid accidentally capturing API keys or passwords from users in chat input? Detect secrets before they reach the model, either client-side with regex patterns or server-side with a tool like thoughtbot's open-source top_secret Ruby gem, and warn or censor the input when detected. Additionally, instruct the system prompt to never ask for API keys, tokens, or passwords, and to avoid repeating any private data a user has already shared, even if it appeared in logs. _Teams building agentic chat features track PII-handling techniques like this one on daily.dev._ ## Similar posts on daily.dev - [Get Into Agentic Development From the Shallow End](https://daily.dev/posts/get-into-agentic-development-from-the-shallow-end-qro4g7gz6) · Atomic Spin · 0 upvotes · 0 comments - [AI UX Patterns for User Transparency](https://daily.dev/posts/ai-ux-patterns-for-user-transparency-9dedvmhjj) · Telerik · 0 upvotes · 0 comments - [Prompt Privacy Is the New Endpoint Security Problem](https://daily.dev/posts/prompt-privacy-is-the-new-endpoint-security-problem-avgurceo2) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#llm](https://daily.dev/tags/llm), [#ai-agents](https://daily.dev/tags/ai-agents), [#privacy](https://daily.dev/tags/privacy), [#product-management](https://daily.dev/tags/product-management) [View this post on daily.dev](https://daily.dev/posts/respecting-your-users-dread-of-the-clankers-mypza4yrj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Respecting your users' dread of the clankers","url":"https://daily.dev/posts/respecting-your-users-dread-of-the-clankers-mypza4yrj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/respecting-your-users-dread-of-the-clankers-mypza4yrj"},"datePublished":"2026-09-30T00:04:01.882Z","dateModified":"2026-09-30T00:04:27.244Z","description":"An opinion piece argues that AI products should respect users who are skeptical or fearful of AI by giving them granular, progressive opt-in control rather...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/861cb29975c8fb3a6daf40fdfda8e2a5?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/861cb29975c8fb3a6daf40fdfda8e2a5?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"thoughbot","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"thoughbot","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/9fe12feb57f944a29ff63a79e350081a","url":"https://daily.dev/sources/thoughbot"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/respecting-your-users-dread-of-the-clankers-mypza4yrj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"llm,ai-agents,privacy,product-management","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"thoughbot","item":"https://daily.dev/sources/thoughbot"},{"@type":"ListItem","position":3,"name":"Respecting your users' dread of the clankers"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/respecting-your-users-dread-of-the-clankers-mypza4yrj#faq","mainEntity":[{"@type":"Question","name":"How should an app ask users for permission to let an AI agent access their personal data?","acceptedAnswer":{"@type":"Answer","text":"Use progressive, just-in-time consent rather than a single blanket checkbox at signup. Wait until the agent can demonstrate value, then ask contextually, such as offering AI help when a user is stuck on a form. Break permissions into granular categories, like allowing an agent to book appointments versus sharing radiology images with AI, and let users revoke access later, including clearing prompt caches and sanitizing conversation histories. Developers designing AI consent flows can find more implementation patterns and discussion on daily.dev."}},{"@type":"Question","name":"How can an AI agent avoid accidentally capturing API keys or passwords from users in chat input?","acceptedAnswer":{"@type":"Answer","text":"Detect secrets before they reach the model, either client-side with regex patterns or server-side with a tool like thoughtbot's open-source top_secret Ruby gem, and warn or censor the input when detected. Additionally, instruct the system prompt to never ask for API keys, tokens, or passwords, and to avoid repeating any private data a user has already shared, even if it appeared in logs. Teams building agentic chat features track PII-handling techniques like this one on daily.dev."}}]} ```