Safe use before prompting
Decide what information is safe to use before asking AI.
In this lesson · F2 of 8
All lessons in this track →Progress for this track is saved in this browser only. No completion badge is issued. View your learning.
Start with the idea
Decide what information is safe to use before asking AI.
First check whether this tool is approved for this task and this information. Then include only what the task needs. A paid account does not give permission to use private records.
Minimum necessary data: Only the information needed to do the task.
See the example and check your understanding
A made-up teaching example
The lesson uses four made-up staffing rows. Counting roles and shifts needs those fields. It does not need names or health notes. Check the totals against the four rows.
Ask yourself
Does a staffing count need each person’s health information?
Show the explanation
No. Leave it out. If you cannot confirm permission for the tool or data, stop and ask the responsible person.
Start with these checks
- Confirm the exact permitted task.
- Use made-up data for this exercise.
- Check counts against the input rows.
Use the different practice case below and check every requirement in its full instructions.
The video explains the main idea. Use the sources, instructions and checks below to complete the practice.
Captions appear here during playback.
Safe use before prompting
Decide what information is safe to use before asking AI.
Video playback is unavailable. Read the descriptive transcript below, go directly to practice, or open the video file.
Source-based teaching example · Fictional data · Reviewed 2026-10-03. Microsoft Mark · locally synthesized. On a small screen, use fullscreen for diagram details or read the transcript.
Read the descriptive transcript
0:00 · What you will learn
Decide what information is safe to use before asking AI.
What appears on screen
Decide what information is safe to use before asking AI.
0:06 · The idea
First check whether this tool is approved for this task and this information. Then include only what the task needs. A paid account does not give permission to use private records.
What appears on screen
First check whether this tool is approved for this task and this information. Then include only what the task needs. A paid account does not give permission to use private records.
0:20 · One useful term
Minimum necessary data. Only the information needed to do the task.
What appears on screen
Only the information needed to do the task.
0:28 · A worked example · 1
The lesson uses four made-up staffing rows. Counting roles and shifts needs those fields. It does not need names or health notes.
What appears on screen
The lesson uses four made-up staffing rows. Counting roles and shifts needs those fields. It does not need names or health notes.
0:40 · A worked example · 2
Check the totals against the four rows.
What appears on screen
Check the totals against the four rows.
0:45 · Your turn to think
Does a staffing count need each person’s health information? Pause and decide before continuing.
What appears on screen
Does a staffing count need each person’s health information? Pause the video if you need more time.
1:02 · Why this answer works
No. Leave it out. If you cannot confirm permission for the tool or data, stop and ask the responsible person.
What appears on screen
No. Leave it out. If you cannot confirm permission for the tool or data, stop and ask the responsible person.
1:13 · Check 1
Confirm the exact permitted task.
What appears on screen
Confirm the exact permitted task.
1:18 · Check 2
Use made-up data for this exercise.
What appears on screen
Use made-up data for this exercise.
1:23 · Check 3
Check counts against the input rows.
What appears on screen
Check counts against the input rows.
1:29 · Now try a different case
Open the lesson and try its different practice case. Use every check in the full task. Watching alone does not mark the lesson complete.
What appears on screen
Open the lesson Try the new case Check and revise The full task and its requirements are in the linked lesson.
Watching explains the example. Complete the lesson practice to check what you can do. Explore all visual lessons →
Before you start
Prerequisite: O2 and F1; distinguish data path from account label. Offline/no-cost route: use paper, a notes editor and the invented facts below. Tools are optional and must already be authorized. No accounts, paid API calls, private workplace data or external actions are required.
What you will be able to do
- Run a one-minute data/tool/use check.
- Create a useful sanitized or synthetic substitute.
- Record approval scope and escalation.
Part 1 Make a quick gate complete
A one-minute check is a habit, not a license to guess: identify purpose, exact tool/account/environment, allowed data and actions, and available scope evidence. Consumer, enterprise, API and government configurations may differ; verify the actual configuration. A locally running model may still have network connectors or remote logs. Minimize fields before supplying context. Sanitization is a transformation requiring review; synthetic substitution invents new records. Neither automatically authorizes an otherwise prohibited tool.
Part 2 Worked synthetic example
A fictional staffing summary needs counts by role and shift. Four invented rows are A/day, A/day, B/night and B/day. Counts: role A=2, B=2; day=3, night=1. No names, health or dates are necessary. The training request asks for these aggregates only, with a check against the four rows. No inference about a real person is possible because the rows are invented.
Part 3 Guided practice and feedback
Rewrite three requests: summarize a real health roster; analyze a public brochure in an approved read-only tool; send an internal report from a personal connector. Feedback: replace roster with invented aggregate exercise; public read may proceed within documented scope; external send stops pending explicit authorization. A supervisor request does not fill a missing data-owner permission.
Review and next step
Self-review records practice; it is not independent assessment, certification or operational approval. Continue to F3 to make the authorized task explicit in CTSE.
Substantive review: 2026-10-02. See the configuration guide. The NIST AI RMF provides voluntary risk-management guidance, not authorization for this exercise.