ai-usage-policy

# AI Usage Policy Skill Most corporate AI policies fail in one of two ways: a fearful ban everyone quietly ignores (shadow AI, zero visibility), or legal fog nobody can apply to the question they actually have — "can I paste this customer email into Claude?" This skill writes the policy as a *decision aid*: one page, answerable in the moment of use, with the reasoning logged separately for counsel. ## What This Skill Produces - A **one-page policy**: approved tools, the data traffic-light, disclosure duties, review obligations, and how to get a tool approved - A **decision log**: the reasoning behind each rule, for legal/leadership review - A **rollout note**: how the policy lands without becoming shelfware ## Required Inputs Ask for (if not already provided): - **The org**: size, industry, regulatory exposure (health, finance, gov contracts change the answers) - **Current reality**: which AI tools are already in use — officially and (honestly) unofficially - **Data landscape**: what sensitive classes exist (customer PII, PHI, source code, financials, client-confidential) - **Enterprise agreements in place**: which tools have zero-retention/no-training terms signed vs consumer accounts - **Risk appetite**: enable-with-guardrails or restrict-hard? (Get the sponsor's one-word answer.) ## Policy Method 1. **Legalise reality first.** Shadow AI is the largest risk *created by* strict policies. Start from what people already use; the policy's first job is making the sanction...