Understand the tool before using it
AI services differ in retention, access and connections to business systems. Check approved tools and accounts. A personal account may not have the contractual protections or administrative settings of the business service, even where both carry the same vendor name.
Start with a defined task and the consequence of a wrong answer or disclosure. Drafting public copy differs from processing employee records or authorising payment. Higher-impact uses need stronger review, ownership and controls. Approval for one task should not be treated as permission for every use.
Protect information and connected systems
Check prompts, attachments and conversation history for personal information, credentials and confidential material. Share only what is necessary and permitted. Removing names may not be enough if other details identify someone or reveal a commercially sensitive project.
Review connectors as carefully as the AI service. They can expose documents, mail or action permissions beyond manually supplied text. Apply least privilege and require approval for consequential actions. Keep external application permissions enforceable even when the model suggests that wider access would be useful.
Treat instructions and outputs critically
Generated answers can be inaccurate or based on misleading sources. Verify important claims and inspect references directly. Give a named person responsibility for checking outputs before customer communication or significant decisions. A fluent explanation is not evidence that the conclusion is supported.
Documents and web pages can contain prompt injection: untrusted instructions trying to redirect the AI. This differs from a malicious user directly asking for an unsafe action. Careful prompt wording does not secure an application by itself; enforce data boundaries and action permissions outside the model.
Build a useful learning and reporting routine
Use the related guides on adoption, prompt security, data protection and SME risks to explore specific decisions. Base exercises on approved workflows, including requests for extra permissions and unexpected content. Staff need to know when to stop and whom to ask rather than improvise a workaround.
Make accidental uploads, suspicious outputs and unintended actions easy to report. Preserve useful details without copying sensitive information into more systems. Support early disclosure and review the controls. Compass is available now; the hub is guidance, not an AI application security product.