What never goes in

Separate three kinds of material

• Suitable starting material: Your published content, approved public templates, and clearly fictional practice data. Still check that you have the right to reuse it and that attachments contain no private comments or hidden details.
• Needs explicit approval: Internal documents, customer information, employee records, financial details, health information, and material covered by confidentiality commitments. Use only when the data owner has approved the particular tool, account, purpose, and controls. Until then, keep it out.
• Keep out of prompts and attachments: Passwords, private keys, recovery codes, and other credentials. Use an approved connection or secret-handling process when a system needs authentication. Never share material you are not authorized to disclose.

"Would I send this to a stranger?" can flag discomfort, but it cannot decide whether a managed business tool is approved. Use the actual organizational rule. If no one can explain that rule, work from a fictional example while the owner decides.

Less information can still teach the pattern

Deleting names is not reliable anonymization. A distinctive role, date, location, transaction, or combination of facts may still identify someone. Use made-up details for practice rather than assuming a lightly edited real record is safe.

For approved live work, include only the fields needed for that purpose. Check extra spreadsheet tabs, comments, document metadata, email signatures, and attachments before sharing.

Check more than the training setting

Ask the account owner to confirm training use, retention, access, enabled connections, deletion, and the relevant organizational commitments. "Not used for training" does not mean "never stored" or "no one else can access it." OpenAI's business privacy page and Anthropic's commercial data guidance distinguish particular products and conditions; check the terms for yours.

Connected office assistants also make existing sharing permissions matter. Google and Microsoft describe controls around authorized access. A tool being able to retrieve a file is not a decision that this task should use it.

For a first rollout, I recommend a clear output rule: nothing an AI system writes reaches a customer, an employee, a payment, or a public statement before a person has approved it. Record the reviewer and the approval step.

If something goes into the wrong place

Stop the activity and tell the named internal contact promptly. Record which tool and account were involved, when it happened, and the type of material without spreading another copy. Follow your incident process for access changes, deletion requests, and any required notifications. Deleting a chat alone is not evidence that every retained copy is gone.

A useful boundary gives people somewhere to ask before they act and someone to tell when they make a mistake. Make those names easy to find.