- Scope ID
- S-1
- Team and contractors
- 24 employees and 4 contractors across service desk, engineering and operations
- Purpose
- Your team is introducing AI into customer support and needs clear rules.
- Review period
- October 2026 fictional exercise
- Excluded areas and reason
- Examples cover organizational decisions and records. The kit does not inspect tenants, scan endpoints or implement technical controls. Each client company needs its own license.
- Accountable owner
- Service operations lead
- Next review
- 2026-10-22
Harbor IT Services — fictional records
Completed example with unresolved work. No source documents or customer records are included.
Policy scope
AI uses
- Use ID
- U-1
- Tool or embedded feature
- SupportDraft
- Account or plan
- Company-managed example account
- Team / role
- Service desk
- Business purpose
- Draft internal support articles from public vendor documentation
- Observed information categories — not permission
- Public documentation and synthetic support tickets
- Permitted information categories
- Public documentation and synthetic support tickets
- Approved use and access conditions
- Service delivery manager checks technical steps and removes customer identifiers
- Permission decision reference
- Fictional records / Harbor IT Services / E-1
- Files, connectors and permitted actions
- No connectors or external actions in this example
- Approval status
- Restricted
- Owner
- Service delivery manager
- Source reference
- Fictional staff disclosure and review note
- Evidence confidence
- Self-reported
- Next review
- 2026-10-22
- Use ID
- U-2
- Tool or embedded feature
- TicketNote
- Account or plan
- Account details awaiting review
- Team / role
- Service desk
- Business purpose
- Summarize customer support tickets
- Observed information categories — not permission
- Customer contacts, infrastructure details and possible credentials
- Permitted information categories
- None pending permission review
- Approved use and access conditions
- Customer owner and security lead confirm permitted fields and processing terms
- Permission decision reference
- Not recorded
- Files, connectors and permitted actions
- Not verified
- Approval status
- Unapproved
- Owner
- Service delivery manager
- Source reference
- Fictional staff disclosure and review note
- Evidence confidence
- Self-reported
- Next review
- 2026-10-22
- Use ID
- U-3
- Tool or embedded feature
- CodeDraft
- Account or plan
- Company-managed example account
- Team / role
- Engineering
- Business purpose
- Suggest internal scripts using synthetic test cases
- Observed information categories — not permission
- Synthetic configuration examples with no secrets
- Permitted information categories
- Synthetic configuration examples with no secrets
- Approved use and access conditions
- Engineer tests changes in an isolated environment; customer execution needs separate approval
- Permission decision reference
- Fictional records / Harbor IT Services / E-1
- Files, connectors and permitted actions
- No connectors or external actions in this example
- Approval status
- Restricted
- Owner
- Service delivery manager
- Source reference
- Fictional staff disclosure and review note
- Evidence confidence
- Self-reported
- Next review
- 2026-10-22
Client restrictions
- Restriction ID
- CR-1
- Client / engagement reference
- Fictional Alder engagement
- AI, data, disclosure or rights restriction
- Customer Alder prohibits uploading raw tickets, credentials and tenant exports. AI-generated changes require engineering review and the existing change-approval process.
- Contract / instruction reference
- Fictional engagement instruction E-1
- Account owner
- Service delivery manager
- Affected use IDs
- U-1; U-2; U-3
- Next review
- 2026-10-22
Policy decisions
- scope rule
- Draft for Harbor IT Services: applies to 24 employees and 4 contractors across service desk, engineering and operations. Examples cover organizational decisions and records. The kit does not inspect tenants, scan endpoints or implement technical controls. Each client company needs its own license.
- accounts rule
- Use only a reviewed tool, account and purpose combination. Personal accounts and new connectors require review.
- data rule
- Customer Alder prohibits uploading raw tickets, credentials and tenant exports. AI-generated changes require engineering review and the existing change-approval process.
- creative rule
- Service delivery manager checks technical steps and removes customer identifiers
- meetings rule
- Check participant permissions, processing terms and retention before any recording or AI summary.
- contractors rule
- Engineer tests changes in an isolated environment; customer execution needs separate approval
- agents rule
- No autonomous actions or new system permissions without the existing change-owner approval.
- people rule
- Consequential decisions about people are outside this initial policy exercise.
- requests rule
- Send new uses and exceptions to the Service operations lead. Keep pending requests paused.
- incident rule
- Stop uncertain use, preserve facts and notify the Service operations lead through the normal incident process.
- review rule
- The Service delivery manager reviews sources and output before external delivery. Review the policy when tools, contracts or data boundaries change.
Document control
- policy version
- 0.3
- policy owner
- Service operations lead
- approver
- Service delivery manager
- approval date
- Not recorded
- effective date
- Not recorded
- review date
- 2026-10-22
- approval reference
- Not recorded
- status
- Draft
- full policy location
- Fictional handbook / draft AI policy
- approved list location
- Fictional approved-use list / review pending
- requests contact
- Service operations lead
- incident contact
- Service operations lead
Requests and exceptions
- Request ID
- EX-1
- Related use ID
- U-2
- Business need
- Summarize customer support tickets
- Requested data and access
- Customer contacts, infrastructure details and possible credentials
- Decision
- Pending
- Conditions and alternative
- Ticket-field redaction and customer permission remain unverified
- Approver
- Service delivery manager
- Decision date
- Not recorded
- Expiry / review date
- 2026-10-22
Rollout records
- Activity ID
- RO-1
- Audience
- 24 employees and 4 contractors across service desk, engineering and operations
- Activity
- Briefing
- Policy version
- 0.3
- Owner
- Service operations lead
- Planned date
- 2026-10-22
- Actual completion date
- Not recorded
- Evidence reference
- Not recorded
- Result and open gap
- Planned only. Approval of the staff policy must precede rollout.
- Activity ID
- RO-2
- Audience
- Staff and contractors after policy approval
- Activity
- Understanding check
- Policy version
- 0.3
- Owner
- Service operations lead
- Planned date
- 2026-10-22
- Actual completion date
- Not recorded
- Evidence reference
- Not recorded
- Result and open gap
- An engineer proposes letting an agent close tickets and modify tenant settings. Record the requested permissions, require change-owner review and test the proposed workflow before authorizing any action.
Rollout participants
No records yet. Follow-up remains open.
Actions
- Action ID
- A-1
- Related use ID
- U-1
- Action and completion evidence needed
- A sample troubleshooting instruction has not been tested. Service delivery manager checks technical steps and removes customer identifiers
- Owner
- Service delivery manager
- Due date
- 2026-10-22
- Status
- In progress
- Completion evidence reference
- Follow-up evidence not yet supplied
- Action ID
- A-2
- Related use ID
- U-2
- Action and completion evidence needed
- Ticket-field redaction and customer permission remain unverified. Customer owner and security lead confirm permitted fields and processing terms
- Owner
- Service delivery manager
- Due date
- 2026-10-22
- Status
- Blocked
- Completion evidence reference
- Follow-up evidence not yet supplied
- Action ID
- A-3
- Related use ID
- U-3
- Action and completion evidence needed
- Two contractors have not confirmed tools or connector permissions. Engineer tests changes in an isolated environment; customer execution needs separate approval
- Owner
- Service delivery manager
- Due date
- 2026-10-22
- Status
- In progress
- Completion evidence reference
- Follow-up evidence not yet supplied
Evidence
- Evidence ID
- E-1
- Related use ID
- U-1
- What this record supports
- Customer data-processing instruction
- Approved repository reference
- Fictional records / Harbor IT Services / E-1
- Owner
- Service operations lead
- Reviewed on
- 2026-10-08
- Scope and limitations
- Illustrative reference only; underlying source document is not included.
- Evidence ID
- E-2
- Related use ID
- U-2
- What this record supports
- Reviewed connector and permission record
- Approved repository reference
- Fictional records / Harbor IT Services / E-2
- Owner
- Service operations lead
- Reviewed on
- 2026-10-08
- Scope and limitations
- Requested; not yet supplied. No permission is established.
- Evidence ID
- E-3
- Related use ID
- U-3
- What this record supports
- Engineering test and change-approval record
- Approved repository reference
- Fictional records / Harbor IT Services / E-3
- Owner
- Service operations lead
- Reviewed on
- 2026-10-08
- Scope and limitations
- Illustrative reference only; underlying source document is not included.
Imported source records
No records yet. Follow-up remains open.