A practical way to begin using AI at work without dragging private, client, HR, finance, confidential, or live-system information into the wrong place.
If you want to learn AI at work, do not start by pasting the most sensitive thing you have. Start with what is already public, approved, synthetic, or deliberately prepared for training.
Why public first.
Public information is a good first surface because the organisation has already chosen to publish it. Your website, public product pages, public policies, help pages, press releases, job adverts, and approved sample material can teach you the workflow without putting people, clients, contracts, secrets, or live systems at risk.
The point is not to stay public forever. The point is to learn the shape of the work before you ask for more access.
Do not use this yet.
For a first exercise, keep these out of the tool unless your organisation has explicitly approved the tool, the purpose, and the boundary:
personal data that is not already approved for this use
client or customer information
HR, employment, health, finance, payroll, banking, or payment data
contracts, commercial secrets, and confidential board or management papers
API keys, passwords, tokens, recovery codes, private keys, and security details
anything behind a login that you are not sure you can use
production data or live systems that can change real records
If you are unsure, use a public page or a made-up sample. A safe example is enough to learn the method.
Use a clean account boundary.
When the work moves beyond a local test, ask whether a dedicated second email or twin account is the right pattern. Something like tony.wood.twin@my-domain.com can be safer than mixing learning experiments into your personal mailbox.
The account should start with least privilege, MFA, no admin rights, and clear ownership. An email alias may be useful, but it is not the same as a separate account if audit, permissions, or offboarding matter.
Ask IT before you look clever.
The best first request is calm and narrow: I want to build my skills. I will start with public or approved sample material. I will not use private, client, HR, finance, confidential, secret, or live-system information without approval. What boundary should I use?
If you are using a harness like Codex, Claude Code, Cowork, or an approved company tool, say that clearly. Explain that your goal is to speed up safe work, share what you learn, invite feedback, and help the organisation roll this out responsibly.
The analogy is simple: you are asking to start swimming in the shallow end. Public information, sample data, visible prompts, draft-only outputs, and human review first. Deeper water comes later, when the controls and skills are ready.
If someone says, "No, we do not use AI here," stay polite. Ask them to help you understand the specific risk if the work uses only public information. Ask what boundary would make the test acceptable. If the answer is still a flat no to any public-information learning, that is a serious organisational signal. Some organisations will choose to be left behind. This training cannot fix that.
A good first exercise.
Ask the agent to review only your public website or public documentation and prepare something useful: a glossary, FAQ, briefing, customer question list, onboarding map, or content gap review.
Then review the answer. Did it cite the public sources it used? Did it guess? Did it invent? Did it ask before going wider? That is the training.
The expansion ladder.
Public. Website, public docs, public policies, public product pages, and synthetic examples.
Approved sample. Deliberately prepared training packs and redacted examples.
Internal read-only. Narrow, approved internal material with a clear owner and review trail.
Narrow private data. Only with the right lawful basis, policy approval, access controls, and review.
Live or write access. Much later, after logs, stop-lines, supervision, rollback, and ownership are working.
Copy these into your agent.
These prompts are designed to make the agent help you stay inside the boundary. They are not permission to ignore your organisation's policy.
Check before you expand.
This page is training, not legal advice. In the UK and Europe, data protection, security, employment, client confidentiality, and sector rules may all matter. Your organisation's IT, security, legal team, and Data Protection Officer decide the real boundary.