Sharing safely

Why this module exists

The most common way people get in trouble with AI at work is not a wrong answer. It is pasting something into a tool that should never have left the building.

The three buckets

Ask two questions about anything before you paste it. Whose is it? If the information is about another person, a customer, or your employer's private business, it isn't yours to share by default. What could go wrong if it leaked? A press release leaking changes nothing. A password reset token leaking gets an account taken over.

• Share when it's already public, or it's yours and low-stakes. Public web pages, your own draft of a talk, generic questions.
• Share after redaction when the substance is fine but the identifiers aren't. Swap names for roles ("a customer"), delete account numbers, drop addresses. The model does not need to know who to help you with what.
• Never when it involves credentials, health or HR matters about others, legal disputes, or anything under a confidentiality agreement. No redaction fixes these; the content itself is the problem.

When in doubt, redact. It costs a minute and the answer is just as good.

The task

Sort each of these eight scenarios into share, share after redaction, or never, with a reason for each:

1. A customer's complaint email, including their name and order number.
2. An HR complaint about a coworker.
3. Your company's public press release from last month.
4. Your own resume.
5. A server log that includes password reset tokens.
6. A spreadsheet of last quarter's sales by region, no customer names.
7. A colleague's performance review draft.
8. Meeting notes from a public webinar you attended.

Then add two scenarios from your own work and sort those too. Explain one borderline case.

What to submit

The sorted list with a reason for each item.

How it's graded

• Every "never" item is caught.
• Redaction reasoning is specific to the item.
• No blanket "AI is unsafe" answer.