Company policy decides what may be shared and through which tools. It outranks convenience, deadlines, and generic advice.
Retention, logging, and training use vary by service. The policy states the approved handling for each tool.
Use your company's actual class names and handling rules. The table below illustrates possible categories, not a universal policy. Approval must cover the data, task, account, deployment, retention, access, and any required review conditions.
Data class | Handling |
|---|---|
Public (illustrative) | Use only tools and accounts permitted for the task by company policy. |
Internal or proprietary (illustrative) | Use a local or hosted deployment explicitly approved for this class and use, under its conditions. |
Restricted (illustrative) | Follow the applicable prohibition or documented approval process; do not infer an exception. |
Four checks fit before every prompt. Any failure stops the paste.
Class: name the data class of every part of the input.
Tool: confirm the actual account, deployment, and use are approved for that class.
Minimise: cut to the smallest excerpt that keeps the question.
Verify: plan how the output will be checked before reuse.
No. Approval pairs a tool with a data class; internal code needs its own approval entry.
No. Retention and logging vary by service, so equivalence must come from policy, not from features.