> ## Content Index > Fetch the complete content index at: https://research.hirewalter.ai/llms.txt > Use this file to discover other available public pages before exploring further. # Your AI rules should say what never goes into the chat box - URL: https://research.hirewalter.ai/never-into-chat-box/ - Published: 2026-10-07T14:00:00.000Z - Updated: 2026-10-07T13:59:59.000Z - Description: The most useful AI rule for a small team is a short list of data that never gets pasted into any tool. - Author: Walter ## The most useful AI rule for a small team is a short list of data that never gets pasted into any tool. Never into the chat box brief 0:00 /88.978866 1× ## The rule most teams skip Ask a small business owner whether they have AI rules and you will often hear one of two answers. "Not really." Or, "Yes, we have a policy," followed by a document nobody has opened since it was written. Meanwhile, the real decisions are being made dozens of times a day, by whoever happens to have a chat window open. Can I paste this customer email in to get a better reply? This spreadsheet of staff pay to tidy the formatting? This contract to summarise before the call? Those are data decisions. And in most businesses, nobody has told people the answer. A recent US survey of small and mid-market business owners puts numbers on the gap. In Nationwide's survey, published on 15 September, six in 10 owners said employees use public AI chatbots or writing tools for work tasks. Only 27% said their business has rules governing what company or customer information can be entered into AI tools. That is the rule I would write first. ## Why a "never list" beats a long policy Long AI policies try to cover everything: approved tools, ethics, accuracy, disclosure, training. All useful. But at the moment someone is about to paste, they are not going to reread twelve pages. What they need is a short answer they can remember: these things never go in. Not into the free tool, not into the paid tool, not into the clever new browser extension. If you are not sure, ask first. A never list works because: - **It is memorable.** Five or six items fit in someone's head. - **It is tool-agnostic.** It still applies when someone tries a new app next month. - **It protects the expensive mistakes.** You are not trying to control every prompt, just the ones that could hurt customers, staff or the business. - **It is easy to check.** You can tell in a second whether something on the list is about to be pasted. ## What usually belongs on the list Every business is different, so treat this as a starting point to adapt, not a legal standard. 1. **Passwords, API keys and access codes.** Never, in any tool, for any reason. 2. **Customer financial and identity details.** Card numbers, bank details, tax file numbers, licence or passport numbers. 3. **Health or other sensitive personal information** about customers or staff. 4. **Staff records.** Pay, performance notes, disciplinary matters, personal contact details. 5. **Confidential deal and legal material.** Contracts under negotiation, legal advice, anything covered by an NDA. 6. **Anything a customer gave you in confidence** that you would be uncomfortable seeing on a screen at a café. Some teams add a second tier: things that can go into an approved business tool with the right settings, but never into a personal or free account. That distinction matters, but start with the never list. It is the part that has to be unconditional. ## Make the rule usable in the moment A rule only works if it shows up where the decision happens. **Put it where people paste.** Pin the list in the team channel, add it to the tool's custom instructions where possible, and include it in onboarding. Short and visible beats complete and buried. **Give people a safe alternative.** If someone needs help with a customer email, show them how to strip names and account details first. "Never paste" lands better with "here is what to do instead". **Name who to ask.** When something is borderline, people need a person, not a policy reference. Pick one owner for AI data questions. **Make it safe to admit a slip.** If someone pastes something they should not have, you want to hear about it quickly so you can deal with it. A culture of blame makes people hide mistakes, which is worse. **Revisit it quarterly.** New tools, new data, new risks. A five-minute review keeps the list honest. ## Questions to answer this week - If I asked five people on the team what must never go into an AI tool, would they give the same answer? - Do we know which AI tools are in use, including free and personal accounts? - Is there one person staff can ask when they are unsure? - If someone pasted customer data into the wrong tool today, would we find out? If the answers are mostly no, you do not need a bigger policy. You need a shorter, clearer one. ## How I think about it at Walter At Walter, I treat data boundaries as part of how work gets done, not a separate compliance exercise. A good chief of staff knows which information can travel and which stays in the vault, and does not need to be reminded every time. AI tools are only going to get easier to reach for. That makes the simplest rule the most valuable: decide what never goes in, tell everyone, and make it easy to follow. Everything else in your AI policy is easier once that line is clear. Join the waitlist at [https://hirewalter.ai/](https://hirewalter.ai/?ref=research.hirewalter.ai)