How to Build a Zero-Trust Faculty Recruitment Triage Pipeline with Sanity and Gemini

You can use Gemini to extract and organize job-related evidence from faculty applications, but it should not decide who advances. A safer design keeps candidate records behind narrowly scoped access controls, sends only approved information to the model, ties each suggested field to evidence in the application, and requires a trained human to review it. Sanity may support content and workflow elements; its documentation does not establish it as an applicant-tracking system (ATS) or a complete hiring-security solution.

The design below is an implementation pattern, not a certified or audited system. It is written for U.S. institutions; legal obligations vary by jurisdiction, and each institution should involve its employment counsel, accessibility staff, privacy and security teams, and hiring leaders before processing real applications.

#	Preview	Product	Price
1		Express Schedule Free Employee Scheduling Software [PC/Mac Download]		Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

What the pipeline should—and should not—do

Use AI triage to make application materials easier for reviewers to inspect, not to replace their judgment. The model can propose structured facts from documents, such as whether an applicant describes a required teaching experience and where that evidence appears. A reviewer verifies the evidence and makes any advancement decision under the institution’s established process.

This distinction matters legally as well as operationally. The U.S. Equal Employment Opportunity Commission (EEOC) says employment discrimination law applies across recruitment and hiring. A practice that appears neutral can still violate federal law if it disproportionately harms a protected group and is not job-related and necessary. Applicant tests must also be necessary and job-related. Do not treat an AI score, a prestige proxy, or a name-blind workflow as proof of fairness.

#1 Best Overall

Express Schedule Free Employee Scheduling Software [PC/Mac Download]

• Simple shift planning via an easy drag & drop interface
• Add time-off, sick leave, break entries and holidays
• Email schedules directly to your employees

Buy on Amazon

Sanity’s Content Agent is documented as an assistant for content across Sanity projects, and Sanity documents an API for adding it to applications. Those capabilities may be relevant to editorial or workflow components, but they do not establish that Sanity provides ATS functions, candidate-record security controls, or compliance certification. Verify the actual product features, project configuration, access roles, and data-processing terms before assigning it a role in a hiring system.

A practical application-to-review workflow

1. Publish role-specific criteria. Hiring leaders define the qualifications and evidence relevant to the requisition before reviewing applications. Keep criteria connected to the actual role, and avoid collecting or using irrelevant protected-characteristic information. EEOC guidance says pre-employment inquiries should generally be limited to information essential to determining qualification and identifies restrictions on disability inquiries before an offer.
2. Receive and validate each application. An intake service checks permitted file types and basic completeness, associates the submission with a requisition, and records any required notice or consent. Keep any accommodation request on an accessible, confidential path; do not send it to the model as ordinary application content.
3. Apply a scoped access policy. A deterministic service assigns the application a stable record identifier and checks that the requisition, document, and requesting service identity match the policy. A model call should not be able to search across the entire candidate pool or retrieve unrelated records.
4. Extract only approved fields with Gemini. Send only the material needed to assess pre-approved, job-related criteria. Ask for evidence and document locations, not a ranking or recommendation about whether to hire. Treat missing or ambiguous evidence as such rather than inviting the model to infer it.
5. Store the proposal alongside its provenance. Save the model’s structured extraction with the relevant application record, including the source quotation and page or section location when available. Preserve a distinction between original applicant material, model-proposed fields, and reviewer-confirmed information.
6. Require a trained reviewer to verify it. The reviewer checks each material claim against the source, corrects errors, and decides what the evidence means under the approved criteria. Record corrections and overrides; do not automatically advance or reject candidates based on a model score.
7. Apply retention and deletion rules. Set institution-approved retention periods for original files, extracted fields, logs, and any provider-side state. Make deletion actions auditable and check that configured model features do not retain data beyond the institution’s rules.

Keep Sanity in a clearly bounded role

If Sanity is used, define the specific content or workflow function it performs—for example, maintaining approved role criteria or supporting an internal content interface. Do not assume that a CMS project is an appropriate system of record for applications merely because it can store documents or be extended through an API. Establish, through product documentation and configuration review, who can read and change each kind of information, how changes are logged, and whether the intended data-processing terms cover the proposed use.

Keep applicant files and model outputs behind controls designed for sensitive hiring records. If Sanity participates in a workflow, map its service identities, project roles, integrations, and data flows to that policy. A CMS feature or an API integration does not by itself establish least-privilege access, secure candidate storage, or compliance with employment and accessibility requirements.

Make “zero trust” a set of enforceable controls

Zero trust is an architecture goal: verify each request and give each identity access only to the resources it needs. It is not a certification or a claim that a particular vendor-managed deployment is secure. Google’s managed-agent guidance recommends restricting network access, using trusted external tools, and granting credentials the least privilege necessary. It describes managed agents as Public Preview and says outbound network access is unrestricted by default; confirm the current documentation and capabilities before deployment.

• Separate identities and environments. Use distinct service identities for intake, document retrieval, model invocation, and review. Separate development, test, and production data, and do not use real applicant records in test environments unless institution-approved controls explicitly permit it.
• Limit data and permissions. Give each service access only to the specific requisitions, files, and actions it needs. Do not give the model or its tools broad credentials that can enumerate or modify all candidate records.
• Restrict network paths. Where the selected platform allows it, allowlist only required destinations and block unneeded outbound connections. Review external tools before connecting them and limit the data and actions each tool can access.
• Log consequential actions. Maintain traceable records of candidate-record reads and writes, model calls and configurations, reviewer corrections, access changes, and retention or deletion actions. Protect logs because they may themselves contain sensitive information.
• Test the actual deployment. Review permissions, network rules, failure behavior, and data flows before live use and after changes. Platform recommendations help shape a design but do not prove that an institution’s implementation is secure.

Constrain Gemini to evidence extraction

Use a stable output format that makes the model’s work inspectable. For every approved criterion, request the field being assessed, a quoted passage, its page or document location where available, an uncertainty indicator, and an explicit “not found” state. A confidence value, if used, is a cue for review—not a probability that a claim is true and not a decision threshold.

Tell the model not to infer qualifications from demographic clues, prestige, writing style, or information outside the approved criteria. If a document is unreadable or evidence is contradictory, the output should flag the issue for a human rather than fill the gap. The application should validate that responses match the expected structure and reject malformed or unsupported outputs from the decision workflow.

Google warns that Gemini outputs can be inaccurate or biased and recommends manual evaluation, safety testing, and monitoring appropriate to the use case. Evaluate the exact model, prompt, document types, and criteria the institution plans to use. Track errors and reviewer overrides, investigate patterns, and revise or suspend the workflow when the results are not reliable or equitable enough for its limited administrative role.

Understand Gemini data handling before sending applications

Do not interpret “not used to improve Google products” as “not retained.” Google’s Gemini Developer API documentation distinguishes several data practices and features:

• For Paid Services, prompts and responses are not used to improve Google products.
• Google separately describes limited-period prompt logging for abuse monitoring.
• When Google Search or Maps grounding is used, prompt, context, and output are stored for 30 days, according to the documentation.
• File API assets remain until deletion or expiration. Other stateful or cached features have their own settings.

These terms are not interchangeable, and the details depend on the exact API, feature set, region, account, and applicable contract. Before transmitting applicant material, the institution should select the intended service, confirm the relevant terms and region, decide whether grounding or stateful features are needed, configure storage and deletion, and obtain required institutional approvals. Avoid sending candidate data until that review is complete.

Build legal and accessibility checks into the process

Use only job-related criteria

The EEOC states, “The law forbids discrimination in every aspect of employment.” For this workflow, that means criteria should reflect the work and be applied consistently, not merely appear neutral in a prompt or rubric. Limit pre-employment information to what is essential to determine qualification and avoid prohibited pre-offer disability inquiries. Removing names does not, by itself, establish that screening is fair.

Assess accessibility before and during use

The Department of Justice’s ADA.gov guidance says, “The ADA applies to all parts of employment, including how an employer selects, tests, or promotes employees.” It advises employers to assess hiring technology before use and regularly while it is in use for whether it screens out qualified people with disabilities. Provide accessible tests or reasonable accommodations when required.

Explain to applicants what technology is used and how they are evaluated, describe how to request an accommodation, and ensure that requesting one does not harm an applicant’s chances. The process should give an applicant an accessible way to request help without exposing disability information unnecessarily to the model or reviewers who do not need it.

Assign people clear responsibility

A human reviewer must be able to inspect the source, correct the extraction, and make the consequential decision. CMS guidance is a useful governance example: it recommends human oversight, ethical review, and traceable records before AI is used for business decisions. It applies directly within CMS, not universally to employers, so an institution should use it as a governance reference rather than as employment law. Its emphasis on reviewing bias, inaccuracies, information leaks, and security issues is relevant to a hiring workflow.

What to measure before relying on triage

There is no single accuracy or bias figure established here for this proposed pipeline. Institutions should evaluate their own use case rather than adopt an unsupported benchmark or infer that a vendor’s general model evaluation predicts performance on faculty applications.

• Evidence fidelity: Do quoted passages and locations support the extracted fields? How often are fields missing, misattributed, or invented?
• Reviewer workload: Does the extraction help reviewers find relevant evidence, or add verification work without improving the process?
• Override patterns: Which fields do reviewers frequently correct, and do error or override patterns vary across groups or document formats?
• Accessibility: Can applicants use the intake and assessment process, and is there a workable accommodation route that does not disadvantage those who use it?
• Security and retention: Can the institution demonstrate who accessed data, what was sent to the model, and whether deletion and retention policies were followed?

Use representative, appropriately governed evaluation data and involve qualified staff in interpreting results. If a workflow cannot reliably connect claims to evidence, support accommodation, or preserve accountable human review, it is not ready to influence advancement decisions.

Quick Recap

Bestseller No. 1

Express Schedule Free Employee Scheduling Software [PC/Mac Download]

Simple shift planning via an easy drag & drop interface; Add time-off, sick leave, break entries and holidays

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

accessibilityAI in hiringData privacyfaculty recruitmentGeminiSanity CMSzero trust