Write Your Team's AI Rules in an Afternoon · Lesson 3 of 7

Write the never-paste list

20 minutes. One short list everyone can remember.

---

A business plan changes who owns the account and how the vendor treats your data. It doesn't make every piece of information safe to paste. Chats are still stored for a while. People still make mistakes, like pasting into the wrong window or the wrong account. And some information has rules attached to it that have nothing to do with AI.

So your team needs a simple list in three parts: what never goes in, what's fine, and what needs a quick check first.

"Use good judgment" asks every person to work out the risk themselves, in the moment, when they're busy. A list does the thinking once. It also makes it easy to say no: "Sorry, that's on the list."

Keep it short. If the never list has thirty items, nobody remembers any of them. Eight to twelve is about right.

Start with these. Most small businesses keep all of them.

• Passwords, PINs, security codes and sign-in links. Ever.
• Full card numbers and bank account or routing numbers.
• Social Security numbers, driver's license numbers, passport numbers and other government ID numbers.
• Health information about a specific person, including employees.
• Employee files: pay, reviews, discipline, medical leave, background checks.
• Anything a contract or agreement says you must keep confidential, such as a client's trade secrets or anything under a nondisclosure agreement.
• Records covered by a privacy law or rule for your field. If you handle patient records, client tax files, student records or legal files, name them here, and ask whoever handles your compliance what's allowed.

Then add your own. A few questions to find them:

• What would you be embarrassed to explain to a customer if it leaked?
• What would a competitor love to see? (Your pricing formula, your bid numbers, your customer list.)
• What would you need to report if it got out?

This list matters just as much. Without it, careful people stop using AI at all.

• Your own public information: your website, brochures, published prices, job ads.
• General writing help: "Make this email friendlier," with names and account details taken out.
• Templates and how-to questions: "Write a checklist for opening the shop," "How do I make a pivot table?"
• Summaries of your own internal notes that don't contain anything from Part 1.
• Brainstorming: product names, social post ideas, ways to word a policy.

Some things are fine with care. Put them here, and name who to ask.

• Customer names and contact details in a draft reply. Often fine on a company account. Your rule might be "first name only."
• Financial reports for your own business.
• Contracts or proposals you want summarized.
• Photos of people, including customers and staff.

Teach everyone this. Before pasting, swap the real details for placeholders: "Customer A," "$X," "[address]." The AI does the job just as well, and you fill the real details back in afterward. It takes ten seconds and removes most of the risk.

Here's how a fictional 14-person flooring company, Harbor Tile & Stone, might fill it in. This is a made-up example to show the shape, not a recommendation for your business.

> Never: passwords and codes; card and bank numbers; Social Security and license numbers; employee pay, reviews and medical notes; customer home security codes and gate codes; supplier pricing sheets (under our dealer agreement); bid totals before a job is awarded. > > Fine: our website and brochures; product care guides; job ads; emails with names swapped out; scheduling templates. > > Ask Dana first: customer names in a reply draft; photos from job sites that show a person or a house number; anything from the accounting system.

• Open the Approved Tools and Data List template and go to Part 2.
• Fill in Never, starting from the list above. Add two or three items specific to your business.
• Fill in Fine, using what your survey showed people already doing safely.
• Fill in Ask first, and name the person to ask.
• Look back at your survey tally. If anything people paste today is now on the Never list, write it down. You'll mention it, kindly, at the rollout meeting.

Finish all three parts of the list and read it out loud once. If any line needs explaining, rewrite it until it doesn't.

• The Never list has 12 items or fewer, and every one is specific.
• The Fine list exists and has real examples on it.
• The Ask first list names a person.
• The swap trick is written at the bottom.

---

→ Next: A person checks it before it goes out

Previous: Move work onto company accounts · Next: A person checks it before it goes out