Data handling and tool authorization gate
Check permission before sharing information with an AI tool.
In this lesson · O2 of 3
All lessons in this track →Progress for this track is saved in this browser only. No completion badge is issued. View your learning.
Start with the idea
Check permission before sharing information with an AI tool.
Permission depends on the information, the tool and the intended action. Removing a name may not make a record safe to share. If permission is unclear, stop before uploading.
Data minimization: Leaving out information the task does not need.
See the example and check your understanding
A made-up teaching example
A fictional roster includes roles, availability, names and health notes. The staffing count needs only roles and availability. There is no approval for the personal account. Practice instead with an invented table.
Ask yourself
Does buying an account make the roster approved for upload?
Show the explanation
No. Use the organization’s approval process. If a spill is suspected, stop and follow its reporting and evidence-handling rules.
Start with these checks
- Check the exact tool and action.
- Use the smallest permitted input.
- Do not delete or forward suspected-spill evidence without direction.
Use the different practice case below and check every requirement in its full instructions.
The video explains the main idea. Use the sources, instructions and checks below to complete the practice.
Captions appear here during playback.
Data handling and tool authorization gate
Check permission before sharing information with an AI tool.
Video playback is unavailable. Read the descriptive transcript below, go directly to practice, or open the video file.
Source-based teaching example · Fictional data · Reviewed 2026-10-03. Microsoft Mark · locally synthesized. On a small screen, use fullscreen for diagram details or read the transcript.
Read the descriptive transcript
0:00 · What you will learn
Check permission before sharing information with an AI tool.
What appears on screen
Check permission before sharing information with an AI tool.
0:06 · The idea
Permission depends on the information, the tool and the intended action. Removing a name may not make a record safe to share. If permission is unclear, stop before uploading.
What appears on screen
Permission depends on the information, the tool and the intended action. Removing a name may not make a record safe to share. If permission is unclear, stop before uploading.
0:20 · One useful term
Data minimization. Leaving out information the task does not need.
What appears on screen
Leaving out information the task does not need.
0:28 · A worked example · 1
A fictional roster includes roles, availability, names and health notes. The staffing count needs only roles and availability. There is no approval for the personal account.
What appears on screen
A fictional roster includes roles, availability, names and health notes. The staffing count needs only roles and availability. There is no approval for the personal account.
0:43 · A worked example · 2
Practice instead with an invented table.
What appears on screen
Practice instead with an invented table.
0:48 · Your turn to think
Does buying an account make the roster approved for upload? Pause and decide before continuing.
What appears on screen
Does buying an account make the roster approved for upload? Pause the video if you need more time.
1:05 · Why this answer works
No. Use the organization’s approval process. If a spill is suspected, stop and follow its reporting and evidence-handling rules.
What appears on screen
No. Use the organization’s approval process. If a spill is suspected, stop and follow its reporting and evidence-handling rules.
1:17 · Check 1
Check the exact tool and action.
What appears on screen
Check the exact tool and action.
1:22 · Check 2
Use the smallest permitted input.
What appears on screen
Use the smallest permitted input.
1:27 · Check 3
Do not delete or forward suspected-spill evidence without direction.
What appears on screen
Do not delete or forward suspected-spill evidence without direction.
1:34 · Now try a different case
Open the lesson and try its different practice case. Use every check in the full task. Watching alone does not mark the lesson complete.
What appears on screen
Open the lesson Try the new case Check and revise The full task and its requirements are in the linked lesson.
Watching explains the example. Complete the lesson practice to check what you can do. Explore all visual lessons →
Before you start
Prerequisite: O1 learning/data contract. Offline/no-cost route: use paper, a notes editor and the invented facts below. Tools are optional and must already be authorized. No accounts, paid API calls, private workplace data or external actions are required.
What you will be able to do
- Classify public, internal, sensitive, CUI, classified, and unknown scenarios.
- Check authorization for the exact tool, account, environment, user, purpose, data, and configuration.
- Respond correctly to a suspected spill.
Part 1 Authorization is a conjunction of facts
Proceed only when the exact user, purpose, data category, tool, account, configuration and environment are in scope. One approved attribute does not approve the others: an enterprise account may still lack permission for a particular dataset or connector. Public, internal, sensitive, CUI and classified labels require the applicable organizational determination; unknown is not public. Logs, uploads, retrieval indexes and outputs can each create additional data copies. Minimum necessary asks which fields the task actually needs. Redaction can leave rare combinations and free text identifying a person. When scope is uncertain, preserve the question and ask the responsible data/security owner before access.
Part 2 Worked synthetic example
A fictional roster has role, availability, name and health note. A staffing-count task needs role and availability, not identity or health. There is no approval for the personal account. Decision: do not upload; use an invented four-row table for training. If a spill is suspected, stop further use, preserve relevant state under policy and report through the required channel. Do not delete or forward evidence without direction.
Part 3 Guided practice and feedback
Case A: invented rows in an allowed training editor: proceed within the exercise. Case B: unmarked internal roster in a personal chat: stop, seek owner scope. Case C: approved public document but an unauthorized message-sending connector: read only if read scope is approved; do not send. Explain each missing or satisfied condition.
Review and next step
Self-review records practice; it is not independent assessment, certification or operational approval. Proceed to O3 to test an isolated synthetic workspace.
Substantive review: 2026-10-02. See the configuration guide. The NIST AI RMF provides voluntary risk-management guidance, not authorization for this exercise.