{"id":"sec-off-password-policy-plain-dos","audience":"office","category":"security","track":"security","technique":"audience","title":"Turn a password policy into five plain-language rules","free":false,"task":"Turn IT's password policy into a printed sheet for the front office. Write exactly 5 numbered 'do' rules, each under 15 words, starting with a verb and speaking to the reader as 'you'. Use only the current version of the policy and no technical terms (no MFA, entropy, credential or authentication). Plain text, under 90 words.","materialLabel":"IT password policy v3 (attached to your prompt automatically)","material":"Harborview Dental Group - Password and Account Policy v3 (effective Nov 1, 2026)\nChanges from v2 are marked.\n\n3.1 Credential length: user-chosen passwords must be at least 14 characters. Passphrases (several random words) are recommended. [CHANGED from 10 characters]\n3.2 Rotation: [REMOVED in v3] v2 required changing passwords every 90 days. v3 requires a change only if a password may have been exposed.\n3.3 Reuse: passwords used for Harborview systems must not be used for any personal or other account.\n3.4 Storage: passwords must be stored only in the approved manager, Keyvault Teams. Writing passwords on paper or in spreadsheets is not allowed.\n3.5 Multi-factor authentication: all staff must approve sign-ins with the Authenticator app. Approve only sign-ins you started yourself.\n3.6 Sharing: credentials must never be shared, including with IT. IT will never ask for your password.\n3.7 Exposure: if you think a password was exposed, contact the help desk (ext. 300) the same day.\n\nAppendix A (for IT only): hashing algorithm, lockout threshold of 10 attempts, audit logging.","rules":[{"type":"numberedItems","count":5},{"type":"plainText"},{"type":"maxWords","max":90}],"mistakes":[{"title":"Using the old version","why":"The AI keeps the 90-day change rule because most policies it has seen include it.","fix":"Say: \"Use only the current v3 rules. The 90-day change was removed.\"","checks":["r1"]},{"title":"Keeping IT's words","why":"The AI copies terms like 'credentials' and 'MFA' that front office staff skip.","fix":"Add: \"No technical terms. Start each rule with a verb, speaking to 'you'.\"","checks":["r0"]},{"title":"Generic advice","why":"The AI writes 'use a password manager' instead of naming the one you have.","fix":"Ask: \"Name our tools and the help desk extension.\"","checks":["r2"]},{"title":"Too much on the sheet","why":"The AI includes every section, even the IT-only appendix.","fix":"Be exact: \"Exactly 5 numbered rules, each under 15 words.\"","checks":["numberedItems","maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in a printed sheet they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Says who it's for","patterns":["front office","staff","non-?technical","reception"]},{"label":"Uses the current version","patterns":["v3","current","removed","90"]},{"label":"Bans jargon","patterns":["jargon","technical terms","plain (english|language|words)","no mfa"]},{"label":"Says exactly how many","patterns":["\\b5\\b.{0,25}(rule|line|item|do)","exactly (5|five)"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"Policies change, and the AI fills gaps with old habits. Tell it which version counts, who's reading, and the exact shape of each rule.","rubricLabels":["Each of the 5 rules is an instruction to the reader starting with an action word (Use, Change, Store, Never, and so on) and uses none of the words MFA, entropy, credential or authentication","Does not tell staff to change their password every 90 days (removed in v3), and any length rule says 14 characters","Includes at least two of these specifics: Keyvault Teams, the Authenticator app, IT will never ask for your password, help desk ext. 300"]}