Agree on the tool first
No client material goes into a new AI product, plug-in, personal account, or integration until the tool and purpose are approved for the engagement.
RESPONSIBLE AI FOR REAL BUSINESS WORK
Use AI without losing control of the work.
A useful AI workflow starts with boundaries: what data may enter, which tools may handle it, what must stay traceable, and who approves the result.
DATA BOUNDARIES
Share the shape of the work before the sensitive details.
The first version of a workflow rarely needs the full client file, candidate record, customer history, or private archive. Start with the least sensitive material that can still test the idea.
Safe starting material
- PublicPages, published offers, public FAQs, and material anyone can already access.
- SanitizedExamples with names, account details, identifying facts, and confidential terms removed.
- SyntheticMade-up records that preserve the shape of the work without exposing a real person or business.
- ApprovedVoice guides, templates, policies, and source documents that an authorized owner has cleared for the workflow.
Hold back until a plan is agreed
- SecretsPasswords, access codes, API keys, private links, and security answers.
- IdentityGovernment IDs, payment details, health information, and other highly sensitive personal data.
- RecordsUnredacted candidate, tenant, customer, patient, employee, or client files.
- StrategyPrivileged advice, confidential contracts, trade secrets, and unpublished intellectual property.
When in doubt
Stop before sharing. Data classification depends on the business, the people involved, and the obligations that apply to the work. A description is enough for the first conversation.
TOOLS AND CONFIDENTIALITY
No surprise tools. No casual copying.
An AI workflow should name the account, purpose, source material, access level, and review owner before real business information enters it.
Use the least data needed
A workflow starts with public, sanitized, or synthetic examples. Real business data is added only when it is necessary and the boundary is clear.
Check the available controls
We review the tool's access, sharing, retention, and privacy settings that are available for the account in use. We do not promise protections a vendor does not provide.
Close access at handoff
Shared accounts, folders, connectors, and temporary access are listed so the client can keep, change, or remove them when the work ends.
SOURCE FIDELITY
AI should be able to show its work.
The more important the claim, summary, or recommendation, the easier it should be for a reviewer to trace it back to an approved source.
Approved source
The workflow starts from material the business has cleared for this purpose.
Traceable draft
Important facts, claims, and summaries can be checked against the material that produced them.
Human decision
A named person reviews the output, resolves gaps, and approves the action or publication.
- Do not fill gapsIf the source does not support a claim, the output should flag the gap instead of inventing an answer.
- Separate fact from suggestionSource-backed facts, AI analysis, and recommendations should not blur together.
- Keep references usefulFor higher-stakes work, retain source links, file names, dates, or quoted passages that a reviewer can verify.
- Correct the systemWhen a reviewer finds an error, update the source, instruction, or review rule so the next run improves.
RISK TIERS
More impact requires more control.
A brainstorming assistant and a workflow that affects a person's job, home, money, health, or legal position should not be treated the same way.
Low risk
Brainstorming with public information, formatting, internal outlines, and tests with synthetic data.
Control: Use approved tools, review before use, and keep confidential material out.
Moderate risk
Customer-facing drafts, analysis of approved internal documents, personalized follow-up, and operational recommendations.
Control: Use a defined source set, a quality checklist, a named approver, and a record of the final version.
High risk
Sensitive personal data, regulated work, legal rights, financial impact, or decisions that materially affect a person.
Control: Pause for specialist review and a more controlled setup. Some workflows should not use AI at all.
HUMAN REVIEW
The person who owns the work also owns the decision.
- 01Name the person who owns the final decision before the workflow is built.
- 02Mark AI output as a draft when another person still needs to review it.
- 03Check facts, claims, tone, omissions, permissions, and the next action against an acceptance checklist.
- 04Escalate uncertainty instead of hiding it behind confident language.
- 05Keep the approved version and the source set when the stakes justify a record.
PROHIBITED USES
Some shortcuts are not on the table.
A useful workflow does not require the business to give up judgment, honesty, privacy, or accountability.
- 01Letting AI make the final hiring, housing, credit, insurance, medical, legal, or financial decision for a person.
- 02Inferring protected or highly sensitive traits that were not provided for a valid, approved purpose.
- 03Inventing candidate experience, client stories, customer quotes, reviews, credentials, evidence, or product facts.
- 04Uploading passwords, access keys, or confidential files to an unapproved tool or personal account.
- 05Impersonating a real person, concealing material uncertainty, or using AI to deceive or manipulate an audience.
- 06Publishing claims or advice without the qualified human review required by the business and the situation.
SECTOR GUARDRAILS
The boundary changes with the work.
These are starting controls, not a substitute for the professional, legal, compliance, or security requirements that apply to a specific organization.
Small businesses
Minimize customer and employee data, verify offers and public claims, and keep a human owner responsible for anything sent outside the business.
Professional firms
Do not place privileged or confidential client material into a workflow until the firm approves the environment. A qualified professional owns advice and final work.
Recruiting and staffing
AI does not choose the candidate, infer protected traits, or embellish experience. Recruiters verify source facts and approve every submission and hiring recommendation.
Real estate
No steering, discriminatory targeting, or invented property facts. Licensed professionals review regulated communications, recommendations, and listing claims.
E-commerce
Prices, inventory, product claims, shipping terms, and return policies come from current approved sources. A person approves campaigns and customer-facing changes.
Creators and coaches
Source material stays traceable, client stories require permission, and AI does not invent quotes or private-session details. Archive access is limited to the agreed purpose.
CLIENT OWNERSHIP
The system should remain useful when the engagement ends.
Ownership and access are made visible in the written scope. The goal is a practical handoff, not a workflow that only works while the consultant is present.
Your sources remain yours
The business keeps control of its source documents, examples, customer knowledge, and original intellectual property.
The scope states the handoff
The written scope identifies the custom workflow definitions, prompt systems, review standards, and exported deliverables the client receives.
Third-party terms still apply
AI platforms, storage providers, and other vendors keep their own account and product terms. Those terms are reviewed as part of tool selection.
No hidden operating dependency
The goal is a workflow the client's team can run, review, and improve, with access and handoff details visible before the engagement closes.
THE FIRST ENGAGEMENT
Start with one workflow and a clear boundary.
The first conversation is about the job, the risk, and the result. Sensitive documents are not required to decide whether the workflow is worth exploring.
Describe one workflow
Start with the repeated task, who owns it, what goes wrong, and what a useful result would change. Do not send the underlying confidential files.
Classify the information
Identify the public, internal, confidential, regulated, and personal information the workflow might touch.
Set tools and boundaries
Agree on approved accounts, access, source material, prohibited inputs, human review, and the conditions that require a pause.
Test with safe examples
Build the first version with public, sanitized, or synthetic inputs, then test accuracy, usefulness, and failure cases.
Handoff and measure
Document how to run the workflow, who approves the output, how access is managed, and what result will be measured next.
START WITH FIT, NOT FILES
Bring one workflow. We will identify the useful boundary first.
A 30-minute fit call is enough to discuss the repeated task, the information involved, the people affected, and whether AI belongs in the workflow at all.
These are practical operating boundaries, not legal advice or a guarantee that a workflow meets every obligation. Your business may require additional legal, compliance, privacy, security, or professional review.