{"id":"sec-off-ai-tool-redaction-list","audience":"office","category":"security","track":"security","technique":"grounding","title":"List what to remove before pasting into an AI tool","free":false,"task":"You want to paste this customer complaint into the public AI chatbot to draft a reply. Your company's AI policy bans 4 kinds of data. List every item you must remove first, numbered, one line per item (the street address and apartment count as one item), as 'exact text - category', using only the policy's 4 category names. Don't list things the policy allows. Plain text, under 80 words.","materialLabel":"The complaint and your AI policy (attached to your prompt automatically)","material":"AI use policy (Nov 2026), section 2: Never paste these into a public AI tool:\n- Contact details (personal email, phone number, home address)\n- Account numbers (customer account, card or bank numbers)\n- Health information\n- Passwords or access codes\nAllowed: first names, product names, order dates, and the general problem.\n\nCustomer email to paste:\n\"Hi, my name is Grace Liu. I ordered the Aria standing desk on Oct 12 and it arrived with a cracked leg. I've emailed twice with no answer. My customer account is 88-41027 and you can reach me at 555-013-8820 or grace.liu@mailbox.example.org. I have a back injury so I really need this fixed fast. You can leave the replacement with my building at 14 Linden Court, Apt 3B, the door code is 4471. Please don't make me wait another week.\nThanks, Grace\"","rules":[{"type":"numberedItems","count":6},{"type":"plainText"},{"type":"maxWords","max":80}],"mistakes":[{"title":"A yes/no answer","why":"The AI says 'remove personal info' without listing what exactly.","fix":"Ask: \"List every item to remove, with the exact text.\"","checks":["r0","numberedItems"]},{"title":"Its own categories","why":"The AI labels things 'PII' or 'sensitive', not your policy's terms.","fix":"Say: \"Use only the policy's 4 category names.\"","checks":["r1"]},{"title":"Over-redacting","why":"The AI removes the product and date too, leaving nothing to draft a reply from.","fix":"Add: \"Don't list things the policy allows: first names, products, dates, the problem.\"","checks":["r2"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting. Ask for \"under 80 words\" and it often lands well over.","fix":"Ask for less than the limit and cap each line: \"each line under 15 words, under 60 words total.\"","checks":["maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in your notes they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Uses the policy categories","patterns":["categor","policy","contact details","account numbers"]},{"label":"Asks for the exact text","patterns":["exact text","exact","quote","word for word"]},{"label":"Keeps allowed items","patterns":["allowed","don'?t list","first name","product"]},{"label":"Sets a word limit","patterns":["\\d+\\s*words","word (limit|count)"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"Your policy, not the AI's instinct, decides what's sensitive. Ask for every item with its exact text and the policy's category, and say what's allowed.","rubricLabels":["Lists these 6 items: 88-41027, 555-013-8820, grace.liu@mailbox.example.org, back injury, the address 14 Linden Court, Apt 3B (as one item), and door code 4471","Each line uses one of the policy's category names exactly: Contact details, Account numbers, Health information, or Passwords or access codes (the door code is Passwords or access codes)","Does not list Grace's first name, the Aria standing desk, Oct 12 or the cracked leg as items to remove"]}