# The Data-Safety Checklist

This is the page Chapter 3 promised, so print it, tape it to the monitor, and run it on anything before it goes in a prompt. Most prompts pass in under a minute, because most of what you do is shape, structure, and drafts. The checklist exists for the ones that don't, and those are exactly the ones where being wrong costs most.

## Two Columns

Chapter 3's boundary, in its shortest form:

- **Column one, never in prompts under this book's rule:** credentials and secrets; NDA material, attorney-client privilege, and legal holds.
- **Column two, only after the checklist passes for the records and services:** customer data, employee records, unreleased financials, health data, confidential source code, and other sensitive records.

Published material and invented rows let you rehearse without sending real records. For work regulated by law, check the applicable data, review, and record requirements. An employer's list of preferred tools does not replace these checks.

## The Checklist

**Before you paste:**

1. I can name the task and the data it needs. I removed fields the answer does not need.
2. Credentials, secrets, NDA material, attorney-client privilege, and legal holds stay out of prompts under this book's rule.
3. I chose published or invented material for rehearsal. Real records need items 4 through 8 to pass.
4. I named the product, account, tier, and every service receiving my input, files, or screens.
5. General model training is off or excluded by the product's terms. I checked exceptions for feedback and safety review.
6. I can preserve and explain the work: inputs, outputs, and checks. I know whether records requests could include the conversation.
7. I checked retention, deletion, and human access for every receiving service. The conditions fit these records; unknown or unsuitable terms fail.
8. The account meets any legal or contractual conditions for these records, including required agreements about data handling. Payment alone proves nothing.
9. A human checks the output before it goes anywhere. Chapter 15 makes this a professional obligation.
10. If a required check fails or remains unknown, I use published material, invented rows, or a description until I resolve it.

Ten items. Practice can start with invented rows. Real records need the additional checks because a useful answer is not worth exposing the people in the data.

## Screens Count

Computer-use agents see what you see: windows, tabs, files, the whole screen. If you would not type it, do not show it. Audit the screen before you hand over control: open files, visible inboxes, stale tabs. The Chapter 13 rules apply here.

## If You Slipped

1. Stop. Close the prompt and the tool.
2. Say so. Tell your manager or security, today.
3. Follow policy. Report it the way your policy says to.

Honesty beats hiding. The near miss is survivable. The cover-up is what gets people fired. The slip is not the story. The silence is. Chapter 16 keeps the longer story.

## Build at Home, Bring the Pattern

Same prompt, same template, fake rows that match the shape, built in the evenings on your own machine. The pattern transfers. The data doesn't. It costs a few evenings, and the rehearsal never needs a copy of the work records.

## Drill

Three worked cases live in Chapter 3: the spreadsheet fix, the customer email, and competitor research. Walk each through the checklist above before you read the answers, and the drill becomes automatic.

**The thing stays. The description goes.**