Protect what goes in.
Use approved tools and keep confidential, regulated, proprietary, client, and security information out of unapproved AI services.
RESOURCE / RESPONSIBLE AI
Use AI. Protect the company. Verify the work.
A practical employee guide for making better decisions before information goes into an AI tool, while it acts, and before its work is used.
THE TEN-SECOND CHECK
Pause before you paste, upload, connect, or send.
01Is this information confidential?02Does it include client, employee, or project data?03Is it regulated, legally restricted, or contractually protected?04Is this tool and this specific use approved?05Will a qualified person verify the result?
THREE RULES
Simple enough to remember.
Strong enough to matter.
Control what AI can do.
Limit permissions and integrations to the task. Use logging and human approval for actions that can affect people, systems, money, or customers.
Verify what comes out.
Check accuracy, sources, assumptions, bias, confidentiality, and technical or professional correctness before relying on the work.
INFORMATION TO PROTECT
Do not enter sensitive information into an unapproved AI tool.
If you are unsure whether a platform or use case is approved, stop and ask before proceeding.
Financial records and banking informationContracts, legal matters, and HR recordsProprietary processes and confidential strategyClient documents, financials, or private communicationsEngineering drawings, architectural plans, and construction documentsPersonal, health, payment-card, or other regulated informationPasswords, MFA codes, network diagrams, and security configurations
HIGHER-AUTONOMY AI
More access requires more control.
When AI can connect to systems or take actions, treat it like a privileged operator—not merely a writing tool.
Least privilege
Give the workflow only the information and permissions required for the approved task.
Meaningful logging
Keep enough activity history to understand what happened, when, and under whose authority.
Human approval
Require review before consequential changes, communications, transactions, or decisions.
A reliable stop
Maintain a clear way to pause access or disable the workflow when behavior or risk changes.
FOR AEC & PROFESSIONAL WORK
AI can assist.
Professional judgment remains accountable.
Contracts, drawings, models, specifications, calculations, estimates, and code-related work can carry client, legal, safety, and professional obligations.
Confirm jurisdiction, code edition, source material, assumptions, and technical accuracy. A qualified professional should review work before it affects a project or deliverable.
Evaluating a new platform?
Open the AI evaluation guide Explore AI operations →LET’S TALK ABOUT WHAT’S NEXT