Library › Cybersecurity AI › IT and security teams

Fill a risk exception form within policy limits

  • For IT and security teams
  • You practice Setting limits and rules
  • Time about 5 minutes

About this exercise

A team asked for a security exception. Fill the exception form in exactly 5 numbered lines labeled Risk, Compensating controls, Owner, Expires, Decision needed. Policy caps exceptions at 90 days from approval, so use a 90-day expiry even though the team asked for longer. Use only facts from the request. Plain text, under 110 words.

Common mistakes when you ask AI for this

  • Granting what was asked. The AI copies the 1-year request into the form. Try: Say: "Policy caps exceptions at 90 days: Expires Feb 11, 2027."
  • Dropping controls. The AI summarizes 'some controls are in place' instead of listing them. Try: Ask: "List each compensating control from the request."
  • Adding opinions. The AI includes Raj's 'just approve it' as a recommendation. Try: Add: "Use only facts from the request."
  • No form shape. The AI writes a memo. Try: Give the fields: "Exactly 5 numbered lines: Risk, Compensating controls, Owner, Expires, Decision needed."
  • Trusting the AI to count words. AI is bad at counting. Ask for "under 110 words" and it often lands well over. Try: Ask for less than the limit and cap each line: "each line under 15 words, under 85 words total."
  • Letting markdown in. AI adds bold and headings by default, and in the form they show up as stray symbols. Try: Add: "Plain text only, no bold, no headings."

What a strong prompt includes

  • Gives the form fields
  • Applies the 90-day cap
  • Says exactly how many
  • Keeps it to the material
  • Asks for plain text

Practice this now ↑

Related exercises