"Quick question. Can I paste a rental application into my ChatGPT to check the income math?"
Nadia got that Slack message on a Tuesday. She owns Sparrowgate Property Management (a made-up 9-person property manager). Applications carry names, Social Security numbers, pay stubs and bank statements.
Her team already had an AI policy: 3 pages, written by an AI in March, built around "use good judgment with confidential information." Nobody could say what that meant for a rental application.
AI Prompts, Reviewed takes one prompt or workflow from How I AI, Claire Vo's show where guests share their screens and walk through how they really use AI. We run it on a small-business job, score it, and tell you what we'd change.
Credit: Based on "How to Create an AI Governance Framework and Tool Library for Your Company," a workflow from How I AI (hosted by Claire Vo, written up by the ChatPRD team), shown by Brian Greenbaum (product designer at Pendo) in the episode "How I AI: Brian Greenbaum's 3-Step Playbook for Driving Company-Wide AI Adoption." Read the original workflow on How I AI. Watch the full episode. Guest site: none listed on the How I AI workflow page.
What the original does
Brian's team at Pendo found people using personal ChatGPT accounts and guessing which data was safe to share. So they built an AI Knowledge Center with legal, security, IT and finance. The workflow runs in 6 steps:
- Measure first with a short anonymous survey on tools, frequency, sentiment, policy awareness and data uncertainty.
- Rank the gaps the survey exposes, like unclear customer-data rules or personal-account use.
- Form a working group with one accountable owner and clear decision rights.
- Build one tool table with purpose, owner, approval status, permitted and prohibited data, retention terms, access steps and a review date.
- Define data tiers with plain-language examples of what each tool may receive.
- Open a request path for new tools with a visible status, then repeat the survey.
The line we'd tape to the monitor: "Map company data classes to concrete allowed and prohibited examples for each approved tool." That is exactly what Nadia's 3-page policy never did.
The test
Everything here is made up.
Run 1, the shortcut: In March, Nadia typed "Write an AI policy for my property management company" into a chat tool. She got 3 polished pages, emailed them out and moved on.
Then the Slack message arrived. So she ran the original's first step: a 7-question anonymous survey. All 9 people answered.
- Seven of 9 used AI at least weekly.
- Five used personal accounts for work, and Nadia was reimbursing all 5 at $20 a month each.
- Six picked "not sure" when asked whether tenant information could go into an AI tool.
- Together, staff estimated they had pasted about 31 rental applications into personal accounts over the past quarter.
That is 5 x $20 = $100 a month, or $1,200 a year, paying for accounts Nadia can't see, can't control and can't clean up when someone leaves.
A policy nobody can apply to a real file is not a policy. It is a vibe.
The rerun
Run 2: same office, our prompt below. The AI asked about Sparrowgate's real files before writing any policy.
It built 3 data tiers with examples from those files. Green: public listings, marketing copy, blank lease templates. Yellow: owner reports and maintenance notes with tenant names removed. Red: applications, Social Security numbers, IDs, bank statements and payment details. Red never goes into any chat tool.
Then it built a one-page tool table. The staff survey listed 6 tools in use. Nadia approved 2: the AI already built into her property software, and one business workspace with admin controls. She retired 3 and parked 1 as "pending review."
The income math that started all this now runs inside the property software, where the applications already live.
The business workspace costs $25 a seat in this example, and 7 people needed it. That is 7 x $25 = $175 a month, or $2,100 a year. Nadia pays $900 more than the scattered personal accounts, and in exchange she controls every account and can delete the data.
A month later, she repeated the survey. All 9 answered again. "Not sure" about tenant data fell from 6 to 1. Personal accounts used for work fell from 5 to 0. Staff filed 3 new tool requests, and Nadia answered 2 of them within 2 business days.
Verdict: 8/10
Strengths: Survey first is the right instinct, because it surfaces the real questions. The tool table with an owner and review date, the data tiers with concrete examples, and a fast request path make a policy usable on a Tuesday afternoon.
Weakness: It's built for a company with legal, security, IT, finance and procurement teams. A 9-person shop has an owner and maybe an outside IT person. The original also leaves the tier examples to you, and that is the step owners skip.
Founder tweak: Shrink the working group to you plus one person, write the 3 tiers using examples from your own files, keep the tool table to one page, and promise an answer on any tool request within 2 business days.
Copy the MCAFax version
This is our own rewrite, not the original. Copy the original from Brian Greenbaum on How I AI.
I own [business type] with [number] people. I want ONE page that tells my team which AI tools they may use and what data may go into each.
Do not write a policy yet.
PART 1. Ask before you write.
Draft a 7-question anonymous survey for my team: which AI tools they use, how often, personal or company account, what they paste in, what they are unsure about, and one task they wish AI could help with. Include "not sure" options.
Wait for me to paste the results back.
PART 2. Data tiers from my real files.
Ask me to list the documents my team touches every week.
Sort them into GREEN (safe for any approved tool), YELLOW (only with names and account numbers removed) and RED (never goes into a chat tool).
Give 3 real examples from my list for each tier. Ask me about anything you can't place.
PART 3. One-page tool table.
For each tool my team uses, list: what it's for, who owns it, approved or retired or pending, which tiers it may receive, company or personal account, cost, and a review date.
Flag any tool where I haven't confirmed the data, training and deletion settings in the vendor's own terms.
PART 4. Request path and check-in.
Write a 5-line request form: task, data tier, tool, cost, who needs it.
Promise an answer within [2] business days.
Write a one-paragraph note to my team explaining the page, then remind me to rerun the survey in 30 days.
Paste into any AI chat, then check each tool's data settings in the vendor's own terms before you mark it approved.
Try this week
- Send the 7-question anonymous survey and wait for every answer.
- List the documents your team touches weekly and sort them into green, yellow and red.
- Build the one-page tool table and retire anything nobody owns.
- Move every work task off personal accounts, starting with anything red.
- If customers also reach you through a chat box, see our customer support chat widget prompt and apply the same red-tier rule to it.
