Staff using AI assistants need four rules: know which tools are approved, keep restricted data out of prompts, check output before relying on it, and report mistakes quickly. Pair the rules with an easy way to ask for a new tool, or people will use unapproved ones.
Start with a policy people can read
One page. List approved tools, what each may be used for, and what data classes may never be entered. Examples of data to keep out unless your policy says otherwise: customer personal data, credentials, unreleased financials, and source code under restrictive licenses.
Teach the four rules
- Use approved tools. Explain why: contracts, data handling settings, and logging differ between tools.
- Mind the data. If you would not paste it into a public forum, do not paste it into a tool that is not approved for it.
- Check the output. Models can state wrong things with confidence. Verify facts, test code, and read generated commands before running them.
- Report problems. If you pasted something you should not have, or output caused trouble, say so quickly. No blame.
For developers, add three more
- Review generated code like any contribution. Run tests and scans.
- Do not accept suggested dependencies blindly. Check that the package exists, is the right one and is maintained.
- Keep secrets out of prompts and out of files the assistant can read.
For anyone using agents or connected tools
When an assistant can read email, files or call tools, instructions hidden in a document can steer it. Teach people to limit what an assistant can access and to review actions that send data or change things. Keep permissions narrow.
Make approval easy
Provide a request form with a quick answer window. If getting a tool approved takes months, people will route around you. Track requests to see what the business wants.
Evidence and records
Record who completed the training and when. If a framework or customer asks about your AI use, you can show a policy, a training record and an approved tool list. Safeguard's compliance and evidence automation can help organize records like these alongside other controls, and its policies, gates and guardrails apply to AI generated changes in pipelines.
Refresh it
AI tools change fast. Review the policy and the training every six months, and send a short note when you approve or retire a tool.
Quick check
Should we ban AI tools until a policy exists?
A ban often pushes use out of sight. A short interim policy with an approved list usually works better.
Do non technical staff need this?
Yes. Data leakage by prompt is most likely among people who do not think of themselves as technical.
Last reviewed: 19 October 2026.
