Start with invented information
For an early test, make up realistic examples. Replacing names in a real record may leave enough detail to identify a person or reveal confidential information. Avoid copying operational records simply because a tool is convenient.
Work through these questions with the owner
- What is in the input? Identify personal details, commercial information, access credentials, restricted documents and third-party material.
- Who may approve its use? Get the relevant information owner and internal specialists involved before any real data leaves its existing environment.
- What does the tool do with it? Check current official documentation, account settings and terms for retention, training use, access and deletion. Do not assume a personal and business account behave the same way.
- Who can see the output? A summary can still contain restricted information. Keep sharing and storage within the agreed boundary.
- What access is actually needed? A draft-only test may need no connection to live systems. Avoid granting broad access for convenience.
Use a simple input register
Input description: Information owner: Sensitivity and restrictions: Approved use and audience: Approved tool/account: Retention and deletion checks: Decision, approver and review date:
Pause when the answer is unclear
Do not treat uncertainty as permission. Return to synthetic examples while the owner resolves it. For higher-risk information or decisions, get appropriate specialist advice before testing.
Keep instructions separate from source material
Documents and messages can contain misleading instructions. Treat their content as material to examine, not permission to change the task or disclose information. Check the proposed output against your original brief.