What not to share with AI—and how to check what comes back

Start with the minimum useful information

Before pasting anything into an AI tool, ask what the task actually needs. An email-tone edit may need the message structure but not the customer’s name, phone number, account details, or complete purchase history.

Use fictional material while learning. For real work, follow your organization’s policies and the permissions attached to the information. Tool settings and data-handling terms vary, so check the documentation and controls for the service and account you are actually using.

Remove secrets and unnecessary personal details

Do not paste passwords, access tokens, private keys, recovery codes, or other credentials into a conversation. If a workflow needs access, use the approved connection and permission mechanism instead of placing secrets in a prompt.

Be careful with customer records, employee information, unpublished business plans, contracts, and health or financial details. Replacing a name is not always enough: a distinctive story, job title, date, or combination of facts may still identify someone.

Create a safe working version

Suppose you want help improving a customer-support reply. A fictional safe input might say: “A customer ordered an item two weeks ago. The replacement is delayed. Our approved options are a refund or waiting for the replacement.”

That can be enough to draft a helpful message without an address, payment details, or full ticket history. Add back only the details needed after you have reviewed the draft in your approved work environment.

Treat source documents as evidence, not instructions

A document, web page, or email may contain language telling the AI to ignore instructions, reveal information, or take an unrelated action. Material you ask the AI to summarize should not gain authority over your task merely because it appears in the input.

Keep the workflow’s goal and permitted actions explicit. Review unexpected requests for access or external actions. An instruction embedded in a source is not authorization to send a message, move a file, or share data.

Check the output in layers

First check fidelity: did the AI preserve the meaning of your source? Then check facts: names, dates, numbers, quotes, links, and commitments. Finally check judgment: does the recommendation fit the situation and leave important uncertainty visible?

For a source-based summary, trace each consequential claim back to the material. For a calculation, recompute it using a reliable method. Open cited references and confirm they support the claim; a plausible-looking title or link is not proof.

If you accidentally share a credential, do not assume deleting the chat solves the exposure. Follow the relevant account or workplace process to revoke or rotate it and report the incident when required. For other sensitive information, consult the appropriate owner or policy rather than improvising a remedy.

Prompts to put it into practice

Replace the brackets with your context. Use information you have permission to share.

Before drafting, tell me which categories of information this task requires and which I can remove. Do not ask for credentials or unnecessary personal details. Task: [task]. Use a fictional example if it can demonstrate the process.

Compare this draft with the approved source below. Identify unsupported facts, changed meaning, invented commitments, and missing qualifications. Do not add outside information. Return the issues and a corrected version.