{"id":"sec-mgr-reply-worried-employee","audience":"managers","category":"security","track":"security","technique":"grounding","title":"Answer an employee's worried question about a breach rumor","free":false,"task":"An employee DMs you: 'I heard we got hacked, is my data out there?' Reply using only the official security note. Exactly 3 lines starting 'Short answer:', 'What happened:' and 'What to do:'. Don't repeat rumors or guess beyond the note. Calm, plain words. Plain text, under 70 words.","materialLabel":"The DM and the official note (attached to your prompt automatically)","material":"DM from Theo (Support team), 10:12 am:\n\"Hey, I heard in the break room that we got hacked and everyone's SSNs are on the dark web?? Is my data out there? Should I freeze my credit?\"\n\nOfficial note from Security (all managers, Nov 6, 2026):\n\"On Nov 4, a criminal used a stolen password to get into one marketing coordinator's email account for about 40 minutes. We locked the account and reset the password. Our review is complete: no employee HR, payroll or Social Security data was in that mailbox or accessed. No other accounts were affected.\nWhat employees should do: nothing extra is needed. As always, report suspicious emails with the Report phishing button. Questions go to security@harborline.example.com.\"\n\nManager notes:\n- Theo is anxious; he had his identity stolen in 2023.\n- Don't share who the coordinator was.","rules":[{"type":"plainText"},{"type":"maxWords","max":70}],"mistakes":[{"title":"Hedging","why":"The AI says 'it's possible' and suggests freezing credit to be safe, which feeds the rumor.","fix":"Say: \"Use only the official note. It says no employee data was accessed.\"","checks":["r0","r2"]},{"title":"Naming the person","why":"The AI mentions the marketing coordinator in a way that identifies them.","fix":"Add: \"Don't identify whose account it was.\"","checks":["r1"]},{"title":"No clear answer first","why":"The AI explains the incident before answering Theo's question.","fix":"Ask: \"First line: Short answer: yes or no.\"","checks":["r0"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting. Ask for \"under 70 words\" and it often lands well over.","fix":"Ask for less than the limit and cap each line: \"each line under 15 words, under 55 words total.\"","checks":["maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in a chat DM they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Uses only the official note","patterns":["official note","only","security('s)? note"]},{"label":"Gives the 3 line labels","patterns":["short answer","what happened","what to do"]},{"label":"Sets a calm tone","patterns":["calm","reassur","anxious","kind"]},{"label":"Sets a word limit","patterns":["\\d+\\s*words","word (limit|count)"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"Worried people need the answer first, and only facts you can stand behind. Give the AI the three line labels and tell it to stay inside the official note.","rubricLabels":["Exactly 3 lines starting 'Short answer:', 'What happened:' and 'What to do:', and the Short answer says no, his HR, payroll or Social Security data was not involved","What happened stays within the note (one email account accessed with a stolen password for about 40 minutes, locked and reset) and does not name the coordinator or repeat the dark web rumor as possible","What to do says nothing extra is needed (no credit freeze advice), mentions the Report phishing button or security@harborline.example.com for questions"]}