- Scope ID
- S-1
- Team and contractors
- 24 employees and 4 contractors across service desk, engineering and operations
- Purpose
- Your team is introducing AI into customer support and needs clear rules.
- Review period
- October 2026 fictional exercise
- Excluded areas and reason
- Examples cover organizational decisions and records. The kit does not inspect tenants, scan endpoints or implement technical controls. Each client company needs its own license.
- Accountable owner
- Service operations lead
- Next review
- 2026-10-22
Harbor IT Services — fictional records
Completed example with unresolved work. No source documents or customer records are included.
Assessment scope
Coverage
- Coverage ID
- C-1
- Team or source
- Staff
- People invited
- 24
- Responses received
- 24
- Evidence source
- Staff questionnaire
- Coverage
- Reviewed
- Missing information and reason
- Responses are disclosures, not technical verification.
- Owner
- Service operations lead
- Coverage ID
- C-2
- Team or source
- Contractors and associates
- People invited
- 4
- Responses received
- 2
- Evidence source
- Contractor questionnaire
- Coverage
- Partial
- Missing information and reason
- Two contractors have not confirmed tools or connector permissions
- Owner
- Service operations lead
AI uses
- Use ID
- U-1
- Tool or embedded feature
- SupportDraft
- Account or plan
- Company-managed example account
- Team / role
- Service desk
- Business purpose
- Draft internal support articles from public vendor documentation
- Observed information categories — not permission
- Public documentation and synthetic support tickets
- Permitted information categories
- Public documentation and synthetic support tickets
- Approved use and access conditions
- Service delivery manager checks technical steps and removes customer identifiers
- Permission decision reference
- Fictional records / Harbor IT Services / E-1
- Files, connectors and permitted actions
- No connectors or external actions in this example
- Approval status
- Restricted
- Owner
- Service delivery manager
- Source reference
- Fictional staff disclosure and review note
- Evidence confidence
- Self-reported
- Next review
- 2026-10-22
- Use ID
- U-2
- Tool or embedded feature
- TicketNote
- Account or plan
- Account details awaiting review
- Team / role
- Service desk
- Business purpose
- Summarize customer support tickets
- Observed information categories — not permission
- Customer contacts, infrastructure details and possible credentials
- Permitted information categories
- None pending permission review
- Approved use and access conditions
- Customer owner and security lead confirm permitted fields and processing terms
- Permission decision reference
- Not recorded
- Files, connectors and permitted actions
- Not verified
- Approval status
- Unapproved
- Owner
- Service delivery manager
- Source reference
- Fictional staff disclosure and review note
- Evidence confidence
- Self-reported
- Next review
- 2026-10-22
- Use ID
- U-3
- Tool or embedded feature
- CodeDraft
- Account or plan
- Company-managed example account
- Team / role
- Engineering
- Business purpose
- Suggest internal scripts using synthetic test cases
- Observed information categories — not permission
- Synthetic configuration examples with no secrets
- Permitted information categories
- Synthetic configuration examples with no secrets
- Approved use and access conditions
- Engineer tests changes in an isolated environment; customer execution needs separate approval
- Permission decision reference
- Fictional records / Harbor IT Services / E-1
- Files, connectors and permitted actions
- No connectors or external actions in this example
- Approval status
- Restricted
- Owner
- Service delivery manager
- Source reference
- Fictional staff disclosure and review note
- Evidence confidence
- Self-reported
- Next review
- 2026-10-22
Exposure review
- Risk ID
- R-1
- Related use ID
- U-1
- What could go wrong
- A sample troubleshooting instruction has not been tested
- Sensitive or client data
- No
- Vendor terms checked
- Unknown
- Client requirements checked
- Yes
- Agent access
- No external actions
- Output review
- Planned
- Safeguards operating today
- Service delivery manager checks technical steps and removes customer identifiers
- Reviewer priority
- Investigate
- Reviewer rationale
- Review the stated gap before wider use
- Reviewer
- Service delivery manager
- Reviewed on
- 2026-10-08
- Risk ID
- R-2
- Related use ID
- U-2
- What could go wrong
- Ticket-field redaction and customer permission remain unverified
- Sensitive or client data
- Yes
- Vendor terms checked
- Unknown
- Client requirements checked
- Unknown
- Agent access
- Unknown
- Output review
- Planned
- Safeguards operating today
- Customer owner and security lead confirm permitted fields and processing terms
- Reviewer priority
- Priority
- Reviewer rationale
- Sensitive client data with unresolved permissions
- Reviewer
- Service delivery manager
- Reviewed on
- 2026-10-08
- Risk ID
- R-3
- Related use ID
- U-3
- What could go wrong
- Two contractors have not confirmed tools or connector permissions
- Sensitive or client data
- No
- Vendor terms checked
- Unknown
- Client requirements checked
- Yes
- Agent access
- No external actions
- Output review
- Planned
- Safeguards operating today
- Engineer tests changes in an isolated environment; customer execution needs separate approval
- Reviewer priority
- Investigate
- Reviewer rationale
- Review the stated gap before wider use
- Reviewer
- Service delivery manager
- Reviewed on
- 2026-10-08
Use decisions
- Decision ID
- D-1
- Related use ID
- U-1
- Decision
- Restrict
- Permitted use and conditions
- Service delivery manager checks technical steps and removes customer identifiers
- Decision owner
- Service delivery manager
- Decision date
- 2026-10-08
- Decision evidence
- Fictional records / Harbor IT Services / E-1
- Next review
- 2026-10-22
- Decision ID
- D-2
- Related use ID
- U-2
- Decision
- Escalate
- Permitted use and conditions
- Pause real-data use until permissions and handling are reviewed.
- Decision owner
- Service delivery manager
- Decision date
- 2026-10-08
- Decision evidence
- Fictional records / Harbor IT Services / E-2
- Next review
- 2026-10-22
- Decision ID
- D-3
- Related use ID
- U-3
- Decision
- Restrict
- Permitted use and conditions
- Engineer tests changes in an isolated environment; customer execution needs separate approval
- Decision owner
- Service delivery manager
- Decision date
- 2026-10-08
- Decision evidence
- Fictional records / Harbor IT Services / E-3
- Next review
- 2026-10-22
Actions
- Action ID
- A-1
- Related use ID
- U-1
- Action and completion evidence needed
- A sample troubleshooting instruction has not been tested. Service delivery manager checks technical steps and removes customer identifiers
- Owner
- Service delivery manager
- Due date
- 2026-10-22
- Status
- In progress
- Completion evidence reference
- Follow-up evidence not yet supplied
- Action ID
- A-2
- Related use ID
- U-2
- Action and completion evidence needed
- Ticket-field redaction and customer permission remain unverified. Customer owner and security lead confirm permitted fields and processing terms
- Owner
- Service delivery manager
- Due date
- 2026-10-22
- Status
- Blocked
- Completion evidence reference
- Follow-up evidence not yet supplied
- Action ID
- A-3
- Related use ID
- U-3
- Action and completion evidence needed
- Two contractors have not confirmed tools or connector permissions. Engineer tests changes in an isolated environment; customer execution needs separate approval
- Owner
- Service delivery manager
- Due date
- 2026-10-22
- Status
- In progress
- Completion evidence reference
- Follow-up evidence not yet supplied
Evidence
- Evidence ID
- E-1
- Related use ID
- U-1
- What this record supports
- Customer data-processing instruction
- Approved repository reference
- Fictional records / Harbor IT Services / E-1
- Owner
- Service operations lead
- Reviewed on
- 2026-10-08
- Scope and limitations
- Illustrative reference only; underlying source document is not included.
- Evidence ID
- E-2
- Related use ID
- U-2
- What this record supports
- Reviewed connector and permission record
- Approved repository reference
- Fictional records / Harbor IT Services / E-2
- Owner
- Service operations lead
- Reviewed on
- 2026-10-08
- Scope and limitations
- Requested; not yet supplied. No permission is established.
- Evidence ID
- E-3
- Related use ID
- U-3
- What this record supports
- Engineering test and change-approval record
- Approved repository reference
- Fictional records / Harbor IT Services / E-3
- Owner
- Service operations lead
- Reviewed on
- 2026-10-08
- Scope and limitations
- Illustrative reference only; underlying source document is not included.
Imported source records
No records yet. Follow-up remains open.