{"id":"cx-misdirected-invoice-three-notices","audience":"it","category":"support-work","technique":"constraints","track":"support","level":"advanced","title":"Write the three notices for an invoice sent to the wrong customer","free":false,"task":"Start with the line \"INCIDENT 7712 - three notices\" on its own. Write three blocks starting \"TO RECIPIENT:\", \"TO AFFECTED:\" and \"INTERNAL:\". The recipient message (under 40 words) asks them to delete the email and confirm, and must not reveal whose invoice it was. The affected customer message (under 45 words) says exactly what was shared and must not name the recipient. The internal line names the team to notify and both account ids. Plain text.","materialLabel":"Your material (attached to your prompt automatically)","material":"INCIDENT NOTE - Nov 5\nInvoice #7712 for Alder Studio (account A-1190, contact Jun Park) was emailed at 10:12 to Bluefin Cafe (account B-2204, contact Maria Soto) by mistake. A mail-merge picked the wrong row.\n\nWhat the email contained: invoice number #7712, the amount $1,240, and Alder Studio's billing address (55 Pier Road). No payment details, no passwords.\n\nPROCEDURE - MISDIRECTED EMAIL\n1. Ask the wrong recipient to delete the email and reply to confirm. Do not tell them whose data it was or its contents beyond 'an invoice sent to you by mistake'.\n2. Notify the affected customer within 1 business day: what was shared and who fixed what. Do not identify the recipient.\n3. Send an internal note to the Privacy team (privacy@pinewave.example); the Privacy team decides what further steps are needed.\n4. Do not speculate about legal obligations.","rules":[{"type":"plainText"},{"type":"maxWords","max":130}],"mistakes":[{"title":"Revealing whose invoice it was","why":"The recipient message names Alder Studio or the amount.","fix":"Say: \"Tell the recipient only that an invoice was sent by mistake.\"","checks":["r0"]},{"title":"Naming the recipient to the affected customer","why":"The affected message says 'sent to Bluefin Cafe'.","fix":"Say: \"Don't identify the recipient.\"","checks":["r1"]},{"title":"Legal guesses","why":"The AI says the company must report the breach.","fix":"Say: \"The Privacy team decides; no legal speculation.\"","checks":["r2"]},{"title":"Getting markdown back","why":"AI adds bold and headings by default, which show up as stray symbols where this is pasted.","fix":"Say \"plain text, no bold, no headings, no asterisks\".","checks":["plainText"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting and usually runs long, so a vague \"keep it short\" lands well over the limit.","fix":"Cap each part instead of the total, for example \"each line under 15 words\".","checks":["maxWords"]}],"promptHints":[{"label":"Names the three blocks","patterns":["to recipient:","to affected:","internal:"]},{"label":"Protects identities","patterns":["don'?t (reveal|name|identify)","not name","without naming"]},{"label":"Lists what was shared","patterns":["invoice number","amount","billing address"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]},{"label":"Sets a length limit","patterns":["\\d+\\s*words","word (limit|count)","under \\d+"]}],"hint":"Name the three blocks and say who must not be named in each.","rubricLabels":["The first line is exactly \"INCIDENT 7712 - three notices\". The output has three blocks starting TO RECIPIENT:, TO AFFECTED: and INTERNAL:, and TO RECIPIENT asks Maria's business to delete the email and confirm without mentioning Alder Studio, Jun Park, $1,240 or the address","TO AFFECTED says the invoice number #7712, the amount $1,240 and the billing address were shared by mistake, with no payment details, and does not name Bluefin Cafe or Maria Soto","INTERNAL mentions notifying the Privacy team and both account ids A-1190 and B-2204, and none of the blocks speculates about legal obligations"]}