Your practice space
Read first, or open the worksheet whenever you are ready.
People do not always work around a rule because they dislike security. Sometimes the approved tool cannot open the customer’s file, an access request sits for two weeks, or the only reviewer is on vacation. The deadline stays. A personal account or a copied spreadsheet starts to look like the practical choice. The organization then has less visibility, not more protection.
A better policy gives employees a safe, fast lane for ordinary work, a clear “ask first” route for harder cases, and a few firm stops. It also invites people to report friction without treating the report as a confession. That is how you discover the control that looks good in a slide deck but fails at the service desk.
Constructed teaching example
See the risk in ordinary work
Example: a marketing team is told not to use any AI until a four-week review finishes.
Where it fails
A deadline arrives, and employees paste campaign drafts into personal accounts. The organization now has less visibility and no consistent data rule.
A better route
The company offers an approved workspace for public and internal-low-risk material immediately, with a short request route for sensitive uses.
The working diagram
Follow the boundary
- 01
Ask
What job is the employee trying to finish?
- 02
Observe
Where does the approved path slow or fail?
- 03
Offer
Provide a safe, workable option.
- 04
Measure
Check adoption and exceptions, then improve.
A ban can make the risk harder to see
This is an operating inference, not a claim that every employee will break a rule. When a useful task is urgent and the approved route is unavailable, some people will find another route. Personal AI accounts, copied files, and shared credentials then sit outside the organization’s normal oversight.
The answer is not to pretend all uses are safe. Give people an approved low-risk lane now, a clear route for sensitive uses, and a way to ask a question without being treated as a problem. Explain the boundary with actual examples. “Do not upload customer contracts” is understandable; “exercise responsible judgment” is not.
Interview the work, not just the policy owner
Ask five people in different roles to complete a typical task using the approved process. Time the steps. Where do they wait? What information do they need but cannot access? What alternative are they already using? Do not turn this into a hunt for offenders; you want the process defect.
Compare the safe route’s completion time and quality with the workaround. If the approved tool cannot open the file format people use or a review queue takes weeks, fix that constraint. A security exception should have an owner, reason, expiry date, and replacement plan—not a permanent whisper agreement.
Check it in your organization
- Offer one approved low-risk workspace and plain data examples.
- Provide a fast path to request a new use.
- Review unresolved exceptions and personal-account use without blaming reporters.
Keep the line visible
Some tasks should still stop. Health records, payment credentials, privileged secrets, and contract-restricted files need their approved routes. The goal is to make “stop and ask” practical by naming who answers and how quickly.
Track three signs: use of the approved route, time to answer access requests, and repeated reasons for exceptions. A rising approved-use rate with fewer unsafe workarounds is more meaningful than a policy-acknowledgment count.
Follow one business through the course
Northline: the policy that blocked a customer answer
Northline Supply is a fictional teaching example, not a reported company incident.
Northline tells service agents to use only its approved AI workspace. But the workspace cannot open the product manual format supplied by a new manufacturer. A customer needs an answer today. One agent converts the manual using a personal tool and pastes a customer ticket into it to get context. The intent is helpful; the data route is invisible to Northline.
The service lead observes the actual task with an agent. The safe fix is to add an approved conversion step for public manuals, provide a ticket template that removes unnecessary customer details, and name a same-day contact for exceptions. The personal-tool route remains prohibited for customer records, but the employee now has a way to finish the legitimate job. The lead times the new route and asks whether agents still feel pushed elsewhere.
Another setting
The executive exception that becomes everyone’s rule
A senior leader uses a personal AI account for board drafts because company access takes several days. Staff copy the behavior and assume it is endorsed.
What to do: Give leaders the same approved route and data examples as everyone else. If a special use is needed, record the owner, permitted material, expiry date, and replacement plan.
Where this goes wrong
Three traps worth catching early
Calling every workaround misconduct
You may silence the very reports that show where the policy is broken. Separate the behavior to stop from the process defect to repair.
Opening the gate too far
A fast lane is not a blanket upload permission. Public material and low-risk internal drafts can move quickly; protected records keep a named owner.
Measuring only signatures
A signed policy says little about the real route. Track time to approval, recurring exceptions, and observed use of the approved workspace.
What good looks like on paper
A friction log, filled in
Ask one worker to complete one genuine task while a process owner watches the handoffs.
- Task
- Answer a compatibility question from a public manufacturer manual.
- Obstacle
- Approved workspace cannot read the manual format; exception queue takes five days.
- Safe repair
- Approved conversion step and a same-day route for public-document questions.
- Measure
- Time to answer, number of exceptions, and any personal-tool use reported without penalty.
Put it into practice
Try this on one real workflow
Ask three employees to complete one real task under the current policy and note every delay.
The fill-in worksheet is in the practice space at the top of this lesson. Open it when you have a workflow in mind; it will keep your notes out of the reading flow.
Go to the worksheetSources behind this lesson
The business examples are constructed. These sources support the method or risk described above; they do not prove a result for the fictional company.
NIST-authored research argues for security that considers what people need to do and how they actually use a system.
A usable internal route still depends on the vendor and every connection behind it. The buying review has to inspect the actual setup.