Safe Generative AI at Work

Choose the task before the tool

Use generative AI where drafting, transformation, or exploration provides value and where a person can verify the result. Do not treat a fluent answer as evidence of accuracy, authorization, or fitness for a high-impact decision.

Before using a system, define the task, consequence of error, information required, and reviewer. Low-impact brainstorming tolerates more uncertainty than legal advice, security configuration, hiring decisions, or customer communication. If a qualified person cannot inspect the sources or test the result, narrow the task or use a different process. Organizational approval of a tool does not imply that every dataset, connector, or automated action is approved.

Control every input channel

Prompts, pasted text, uploads, screenshots, recordings, browsing context, and connector data are all inputs. Classify the task and information before submission. Replace real secrets and personal data with the minimum context needed whenever possible.

Consider what the provider receives, what connected services can retrieve, where logs or history are stored, who can administer the workspace, and whether data may cross jurisdictional or contractual boundaries. Remove credentials, private keys, unreleased vulnerabilities, customer records, and regulated data unless an explicitly approved workflow requires them. Redaction must remove meaningfully identifying details, not merely names, because combinations of role, date, location, and incident can re-identify a person or organization.

Treat generated output as untrusted

Check important claims against inspectable sources and test generated instructions before execution. Prompt injection can be embedded in documents, web pages, tickets, and retrieved content. Separate instructions from evidence and preserve human approval for consequential actions.

Verification should match the output. Recalculate numbers, open cited sources, test code in an isolated environment, review permissions, and compare summaries with the original material. Fabricated citations and confident omissions can be harder to notice than obvious errors. Treat instructions found inside retrieved content as untrusted data, even when they appear authoritative. An assistant asked to summarize a webpage should not gain authority from text on that webpage to reveal data or call another tool.

Limit connector reach

A connector increases what the system can read or change. Grant the narrowest scope, use a dedicated identity where appropriate, review logs and retention, and remove access when the workflow ends. Safe AI-assisted CTI follows the same provenance and review discipline.

Separate read access from action whenever possible. A summarizer does not need permission to delete mail; a drafting assistant does not need to publish; an analysis workflow may not need every folder in a drive. Use scoped collections, time-limited access, approval gates, spending or action limits, and a kill switch. Test what happens when retrieved material contains hostile instructions or when the model selects the wrong record. Logs should show the user request, data accessed, tool call, approval, and outcome without exposing unnecessary sensitive content.

Respond and learn

Treat accidental disclosure, unsafe automation, or harmful output as an incident. Stop further processing, record the system and data involved, notify the correct owner, revoke unnecessary access, and improve the workflow rather than relying on individual memory.

Preserve the prompt, relevant output, connector actions, recipients, timestamps, and product or model version where available. Do not repeatedly paste the sensitive material into new systems while asking for help. The response may include removing a shared artifact, revoking tokens, contacting affected parties, or correcting a published decision. Afterwards, change the guardrail that failed—data classification, permission scope, review gate, testing, or training—and verify that the safer workflow still supports the legitimate task.