{"id":"sec-hr-direct-deposit-requests-triage","audience":"hr","category":"security","track":"security","technique":"constraints","title":"Triage direct deposit change requests by policy","free":false,"task":"Payroll got 4 direct deposit change requests this week. Label each per policy as 'Process' or 'Hold - verify' with the reason, as exactly 4 numbered lines like '1. Name - Hold - verify - reason'. Plain text, under 120 words.","materialLabel":"Requests and the payroll policy (attached to your prompt automatically)","material":"Payroll policy PR-2 (direct deposit changes):\n- Process: changes the employee made themselves in the HR portal (the portal requires their sign-in approval).\n- Hold - verify: any change requested by email, phone or chat, even from a work address. Verify by calling the employee at the number in their HR file, then have them make the change in the portal.\n- Changes within 3 days of payday also need the payroll manager's sign-off, but they still follow the rules above.\n\nRequests (payday is Friday Nov 14):\n1. Ana Ruiz - changed in HR portal on Nov 3.\n2. Ben Okafor - email from ben.okafor@coralbay-health.example.org on Nov 11: \"New bank, please update before Friday, new details below.\" Sent from his real work address.\n3. Carla Diaz - changed in HR portal on Nov 12.\n4. Dev Patel - text message to the payroll phone on Nov 10 from a number not in his file: \"Hi it's Dev, lost my phone, new bank details attached.\"\n\nNote: Ben is a long-time employee and his manager says \"just do it, he's legit\".","rules":[{"type":"numberedItems","count":4},{"type":"plainText"},{"type":"maxWords","max":120}],"mistakes":[{"title":"Trusting the work address","why":"The AI processes Ben's request because it came from his real email.","fix":"Say: \"Any request by email, phone or chat is Hold - verify, even from a work address.\"","checks":["r0","r1"]},{"title":"Missing the payday rule","why":"The AI processes Carla without noticing the 3-day sign-off rule.","fix":"Add: \"Payday is Fri Nov 14. Note any change within 3 days.\"","checks":["r1"]},{"title":"No fixed labels","why":"The AI writes 'probably fine' or 'be careful'.","fix":"Give the labels: \"Process or Hold - verify, with the reason.\"","checks":["r2","numberedItems"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting. Ask for \"under 120 words\" and it often lands well over.","fix":"Ask for less than the limit and cap each line: \"each line under 15 words, under 80 words total.\"","checks":["maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in the payroll log they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Gives the labels","patterns":["process","hold"]},{"label":"Uses the policy","patterns":["policy","pr-2","portal","email.{0,20}(hold|verify)"]},{"label":"Mentions the payday rule","patterns":["payday","3 days","nov(ember)? 14","sign-?off"]},{"label":"Says exactly how many","patterns":["\\b4\\b.{0,25}(line|request|item)","exactly (4|four)"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"Direct deposit fraud often comes from a real account that's been taken over. Give the AI the policy's exact labels and the payday date so it can apply every rule.","rubricLabels":["Ana Ruiz and Carla Diaz are Process; Ben Okafor and Dev Patel are Hold - verify","Ben's line holds his email request despite the manager's OK, and Carla's line mentions the payroll manager's sign-off","Every line follows 'Name - Process or Hold - verify - reason'"]}