{"id":"sec-it-cert-expiry-renewals","audience":"it-security","category":"security","track":"security","technique":"constraints","title":"Pick which certificates to renew this month","free":false,"task":"From this certificate report, list only certificates with 30 or fewer days left, numbered, as 'name - days left - Owner: name', in the report's order. Skip ones already marked as auto-renewing and ones being retired. Plain text, under 60 words.","materialLabel":"Certificate report (attached to your prompt automatically)","material":"TLS certificate report - Nov 6, 2026\n\nname                  | days left | auto-renew | owner      | note\nwww.harborline.example.com    | 12  | yes | Web team (Ana)   |\napi.harborline.example.com    | 9   | no  | Platform (Ravi)  |\nvpn.harborline.example.com    | 27  | no  | Network (Priya)  |\nlegacy.harborline.example.com | 5   | no  | Web team (Ana)   | site retired Nov 15, do not renew\nmail.harborline.example.com   | 45  | no  | Servers (Sam)    |\nsso.harborline.example.com    | 30  | no  | Identity (Lin)   |\nshop.harborline.example.com   | 61  | yes | Web team (Ana)   |\n\nNotes:\n- Policy: renew any cert with 30 or fewer days left unless it auto-renews.\n- Last year api.harborline.example.com expired and took down the mobile app for 3 hours.","rules":[{"type":"numberedItems","count":3},{"type":"plainText"},{"type":"maxWords","max":60}],"mistakes":[{"title":"Missing the boundary","why":"The AI treats 30 days as 'not yet' and drops sso.","fix":"Say: \"30 or fewer days left counts.\"","checks":["r0"]},{"title":"Listing what renews itself","why":"The AI includes www because it's close to expiry, and legacy because it's urgent.","fix":"Add: \"Skip auto-renewing and retired certs.\"","checks":["r1"]},{"title":"No owner","why":"The AI lists certs but not who renews them.","fix":"Ask: \"End each line with Owner: name.\"","checks":["r2","numberedItems"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting. Ask for \"under 60 words\" and it often lands well over.","fix":"Ask for less than the limit and cap each line: \"each line under 15 words, under 45 words total.\"","checks":["maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in the team channel they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Gives the 30-day rule","patterns":["30","or fewer","days left"]},{"label":"Skips auto-renew and retired","patterns":["auto-?renew","retired","skip"]},{"label":"Asks for owners","patterns":["owner"]},{"label":"Sets a word limit","patterns":["\\d+\\s*words","word (limit|count)"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"Renewal lists go wrong at the edges: exactly 30 days, auto-renew, retired sites. Spell out each rule and ask for an owner on every line.","rubricLabels":["Lists exactly api.harborline.example.com, vpn.harborline.example.com and sso.harborline.example.com, in that order","Does not list www (auto-renews), legacy (retired), mail (45 days) or shop","Each line follows 'name - days left - Owner: name' with the right owner (Ravi, Priya, Lin)"]}