Before choosing an artificial intelligence (AI) tool, define the work, the result, the owner, and a way to finish without AI. These 27 checkpoints adapt the supplied personal task process matrix for reading on the web. They describe a planning aid, not a certification or permission to share information.
For beginners, Start Here and the Guided Planner provide a shorter entry point. The process IDs below identify task checkpoints; they are separate from the checklist's Protect IT IDs.
For practical examples behind P08-P11 and P19-P22, see the Advanced guide's input and output rules and worked example. IT teams can also use the audit-record checklist to connect approved inputs, control decisions, actual actions and output destinations.
P01: Define the task and whether AI helps
Stage: 1 Plan. Pillar: Own IT.
Check: Decide whether AI belongs in this task at all.
Ask: What problem am I solving?; What decision will the result support?; Would ordinary software or doing it myself work as well?
Keep: One-sentence task statement; Reason to use or skip AI; Named person responsible for the result
Move on when: Task and owner written down; continue to P02.
P02: Map the manual way and a fallback
Stage: 1 Plan. Pillar: Own IT.
Check: Keep a way to finish without AI.
Ask: How would I do this without AI?; What could go wrong if the AI is unavailable or wrong?
Keep: Short list of manual steps; Fallback plan if AI fails; The checks you'd use either way
Move on when: Manual route and fallback noted; continue to P03.
P03: Set success, risk limits and stop conditions
Stage: 1 Plan. Pillar: Own IT and Protect IT.
Check: Set your risk limits and when to stop before you start.
Ask: What does a good result look like?; How sensitive is the data, and how costly is a wrong answer?; When would I stop and do it another way?
Keep: Written success check; Highest setup level allowed (0 to 6); Stop conditions; Go or no-go for AI
Move on when: Success, limits and stop conditions noted; continue to P04.
P04: Choose the AI tool, account and plan
Stage: 1 Plan. Pillar: Own IT and Secure IT.
Check: Match the plan's terms to the data.
Ask: Personal or work account?; Free, paid personal or business plan?; What do the terms say about training, retention and ads?; Does the task need a BAA or DPA?
Keep: Chosen tool, account, plan and app (web, desktop or mobile); Entry in your private AI list; Known training and retention terms
Move on when: Account, plan and app noted; continue to P05 (or P08 if setup is current).
P05: Secure the account and device
Stage: 2 Set up. Pillar: Secure IT.
Check: Phishing-resistant sign-in; protected recovery.
Ask: Is sign-in phishing resistant?; Is account recovery protected?; Is the device updated and locked?
Keep: Hardened sign-in; Verified recovery; Updated, locked devices; Old sessions signed out
Move on when: Sign-in, recovery and devices checked; continue to P06.
P06: Set privacy, memory, cookie and ad preferences
Stage: 2 Set up. Pillar: Secure IT.
Check: Training off, memory reviewed, history and cookies set on purpose.
Ask: Is training off?; What does memory hold, and what instructions or project files carry into chats?; How long is history kept?; Which optional cookies and ad personalization are on?
Keep: Training off; Memory reviewed and on or off decided; History or auto-delete setting chosen; Optional cookies declined where offered; Choices and date noted in your private list
Move on when: Privacy choices recorded with the date; continue to P07.
P07: Set safe defaults for capabilities
Stage: 2 Set up. Pillar: Secure IT.
Check: Least privilege by default: automatic search, connectors and agents off.
Ask: Does the AI search the web, apps or files on its own?; What can it do without asking?; Which connections and add-ons are already on?
Keep: Automatic search off where a control exists; Unused connections removed, starting with personal email and calendar; Agents and schedules off by default; Add-ons trimmed; Stop control located
Move on when: Defaults set and noted; continue to P08.
P08: Identify data sources and decide how much
Stage: 3 Prepare the data. Pillar: Own IT and Protect IT.
Check: Data minimization; permission for other people's data.
Ask: Where does the needed data live?; Who owns it, and may I share it?; What's the minimum: which fields, dates and how many items?; Is any of it untrusted?
Keep: Approved source list; Data budget: fields, date range, number of items; Each source marked trusted or untrusted; Permission confirmations
Move on when: Sources and data budget noted; continue to P09.
P09: Map where copies will go
Stage: 3 Prepare the data. Pillar: Own IT.
Check: Know every place a copy could end up before anything is shared.
Ask: Where will this data travel: AI company, connector, search partner, app, recipients?; Which copies will need cleanup later?; What don't I know yet?
Keep: Simple copy map: source to AI to recipients; List of copies to clean up later (chats, files, memories, links, exports); Open questions
Move on when: Copy map noted; continue to P10.
P10: Prepare and sanitize the inputs
Stage: 3 Prepare the data. Pillar: Protect IT.
Check: Sanitize before the chat box; keep the label key outside AI.
Ask: What can I remove?; What needs a label?; Could what's left still identify someone?; Is there hidden content or metadata?
Keep: Sanitized working copy; Private label key, kept outside AI; Plain text or metadata-cleaned file; Message or source numbers for citing
Move on when: Sanitized copy and private label key ready; continue to P11.
P11: Choose how data gets in: paste, upload or connector
Stage: 3 Prepare the data. Pillar: Secure IT and Protect IT.
Check: Choose the route the AI can see: selected copies beat connections.
Ask: Can I paste or upload a selected copy instead of connecting?; If I connect, can I limit it to only the approved items?; Does a connector bypass my cleanup?
Keep: Chosen route; Exact list of what will be shared; Note of the boundary the AI can reach
Move on when: Route chosen and noted; continue to P12.
P12: Write the prompt and output request
Stage: 3 Prepare the data. Pillar: Protect IT.
Check: Keep your instructions separate from outside content.
Ask: What exactly am I asking?; What format do I want back?; How should the AI handle things it doesn't know?
Keep: Reviewed prompt; Expected output structure; Instructions to cite sources, show calculations and mark unknowns
Move on when: Prompt ready for review; continue to P13.
P13: Decide on the web search lane
Stage: 4 Configure this session. Pillar: Secure IT and Protect IT.
Check: Control the web exit: no automatic search with sensitive data.
Ask: Does this task need current web information?; Is anything private in this chat or in memory?; Which company runs the search?
Keep: Decision: web search off, or on with nothing private; Separate research chat, if needed; Note of what may be searched
Move on when: Web decision noted; continue to P14.
P14: Decide whether the AI may act, and test the stop
Stage: 4 Configure this session. Pillar: Secure IT and Protect IT.
Check: Least agency and human approval: draft only by default; tested kill switch.
Ask: Should the AI act, or only draft?; Can I watch it the whole time?; Have I tested the stop control?
Keep: Decision: draft only, or act with approval; Stop control tested on a harmless task; Limits set where offered
Move on when: Action decision and stop test noted; continue to P15.
P15: Final go or no-go
Stage: 4 Configure this session. Pillar: Protect IT.
Check: Release gate: the three questions answered for this exact data and setup.
Ask: Is this exact copy okay to share?; Do the tool, account and settings match the plan?; Do the web search and action decisions fit this data?; Is it for the purpose I approved?; Do I know how to pull the plug, and will I be nearby?
Keep: Go or no-go; Note of what will be shared, where and when; Stop control and who is watching, confirmed
Move on when: Go decision noted; continue to P16 if connecting, otherwise P17.
P16: Connect approved sources, only if needed
Stage: 4 Configure this session. Pillar: Secure IT and Protect IT.
Check: Scoped, time-limited, read-only unless actions were approved.
Ask: Is the connector limited to the approved items?; What else can it reach?; When will I disconnect?
Keep: Scoped connection; Recorded permissions; Revocation plan
Move on when: Connection and permissions noted; continue to P17.
P17: Run the session and supervise it
Stage: 5 Run and review. Pillar: Protect IT and Monitor IT.
Check: Treat content as information, not instructions; supervise any actions.
Ask: Right chat type?; Is anything private already in this chat?; If the AI acts, am I watching?
Keep: AI response; Chat saved in history, unless temporary; Possible memory updates; Generated files
Move on when: Run reached a known state; continue to P19, or P18 if incomplete.
P18: Handle gaps, retries and interruptions
Stage: 5 Run and review. Pillar: Protect IT and Monitor IT.
Check: Know the status before retrying anything.
Ask: Did anything already happen, like a message sent or a charge made?; Is the problem the input, the tool or a service outage?; Should I retry, change course or stop?
Keep: Decision: resume, retry, revise or stop; Checked status of partial actions; Note of where you left off
Move on when: Known state restored; return to P17, or use the manual route.
P19: Inspect outputs before opening or running them
Stage: 5 Run and review. Pillar: Protect IT.
Check: Treat outputs as untrusted until checked.
Ask: Does the answer contain links, code, files or formulas?; Is it asking for anything: sign-in, payment, more access?; Is it what I asked for?
Keep: Output checked for links, code, formulas and requests; List of anything suspicious; Safe copy to review
Move on when: Output safe to review; continue to P20.
P20: Verify and restore the output
Stage: 5 Run and review. Pillar: Protect IT.
Check: Verify against originals; restore labels locally.
Ask: Is it accurate and complete?; Does it match the sources?; Are labels restored to the right people and accounts?
Keep: Verified result; Restored final copy, made locally; List of corrections or accepted limits
Move on when: Success check met or limits accepted; continue to P21.
P21: Use and share the output
Stage: 5 Run and review. Pillar: Protect IT.
Check: A person performs the action; check sharing and audience.
Ask: Where does the result go?; Who will see it?; Does it carry sensitive details?
Keep: Message, event, file or decision, made by you; Shared items with the right permissions; Note of what was sent and to whom
Move on when: Action done and checked, or not needed; continue to P22.
P22: Save results and a short record
Stage: 6 Close out. Pillar: Protect IT.
Check: Protect kept copies; record decisions, not secrets.
Ask: What do I need to keep, and for how long?; Where will it live, and does that folder sync online?; What would I need to explain this later?
Keep: Protected local copy; Short record: what was shared, where, when and what was checked; Review or deletion date
Move on when: Result and record saved with a review date; continue to P23 or P24.
P23: Stop tasks and revoke access used for this task
Stage: 6 Close out. Pillar: Secure IT and Monitor IT.
Check: Stop first, then revoke at the source.
Ask: Is anything still running or scheduled?; What did I connect or allow for this task?; Did I revoke it at the source too?
Keep: Running and scheduled tasks stopped; Connections removed in the AI tool; Permissions revoked at the source; Deletion requested from middlemen, if used
Move on when: Future access narrowed and confirmed; continue to P24.
P24: Clean up what the AI side keeps
Stage: 6 Close out. Pillar: Protect IT.
Check: Archive, disconnect, delete and revoke do different things; follow every copy.
Ask: Which copies from my copy map still exist?; What do I still need there?; When should I check that deletion finished?
Keep: Deleted chats, files, memories and links; Recorded decision for every mapped copy; Follow-up date for deletion
Move on when: Every mapped copy has a decision and follow-up date; continue to P25.
P25: Monitor and review
Stage: 7 Ongoing. Pillar: Monitor IT.
Check: Detect: alerts, unfamiliar memories, rules and settings switched back on.
Ask: Has anything changed since the last check?; Any surprise activity?; Did an update change my settings?
Keep: Monthly check done; Quarterly review sheet; Updated private list; Follow-ups with dates
Move on when: Review done and next date set; return to P01 for the next task.
P26: Respond when something goes wrong
Stage: 7 Ongoing. Pillar: Secure IT, Protect IT and Monitor IT.
Check: Contain, revoke, recover and report.
Ask: What happened, and is it still happening?; What's exposed?; Who needs to know?
Keep: Activity stopped; Access revoked; Passwords changed; Report filed, if required; Lessons noted
Move on when: Incident contained; revisit P03 to P15 before resuming.
P27: Retire tools and close accounts
Stage: 7 Ongoing. Pillar: Own IT, Secure IT and Monitor IT.
Check: Decommission: export, cancel, delete the account, remove sign-in links.
Ask: Do I still use this tool?; What depends on it: billing, sign-ins, connections?; What do I need to keep first?
Keep: Cancelled subscription; Exported records, if needed; Deleted account; Removed sign-in links; Updated private list
Move on when: Account, billing and records handled; private list updated.
Repeat the review
A person remains responsible for the result. Stop when the task, data, destination, or allowed action changes. Review the new situation before continuing, and keep a usable manual fallback.
The author develops commercial security tools in this area. These resources are tool-neutral and recommend no product. Product names, when used, are examples rather than endorsements. Own IT, Secure IT, and Protect IT draw on the 2019 Cybersecurity Awareness Month theme; Monitor IT extends the cycle into a repeatable personal habit. General educational information, not a scan, compliance assessment, or guarantee of safety. CC BY 4.0.