Using AI at work safely: what to share and what to keep back

AI is most useful at work when it can do real things: read your files, log in to your systems, draft and send email. That is also exactly why a few good habits matter. None of them are hard. Most are the same judgment you already use with a new colleague. Here is what to share, what to keep back, and how to stay in control.

A quick note first: this is practical guidance, not legal advice. Every organisation has its own rules about data, clients and privacy. Check your organisation’s policy, and follow it where it says more than this article does.

Know where your messages go

Start with the basics. When you send a message to an AI tool, it goes to the provider of the model you are using, such as Anthropic or OpenAI. That is true whether you use their app directly or a platform that sits on top.

So ask two questions about any tool you use at work:

• Whose AI accounts do the messages go through? Your organisation’s own subscriptions or API keys are the cleanest answer, because your organisation then controls those accounts and their settings.
• Does the platform maker collect the chat content? You want a clear no.

Also check your AI provider’s settings about training on your chats, and switch that off if your policy requires it.

Passwords and keys are credentials, not text

Never paste a password or an API key into a chat. Anything typed into a chat stays in it. If the chat is shared later, everyone in it can read the whole history. A password pasted today could be read by someone months from now.

The safer pattern is to give the AI a login the way you would give a system access: as a stored credential.

• Store it once. The agent can use the login without anyone seeing it in the chat.
• Use without seeing. Most people only need their agent to use a login, not to see its value.
• Share narrowly. Share a login only as widely as the work needs: one team, not the whole organisation.
• Link, do not copy. If you keep passwords in a password manager, link the item instead of copying the value, so a changed password just keeps working.

Pasted one by mistake? Change the password itself, then add the new one as a credential.

Try saying:

Which credentials can you use in this team chat, and what is each one for?

Be careful with actions that reach the outside world

An agent can do things, not just write things. It can send an email, change a record, fill in a form or upload a file. Some of those cannot be taken back. Keep yourself in the loop for those.

Draft first, send later

The simplest habit: let the agent prepare, and you press go.

Try saying:

Draft the emails to all twelve clients, but don’t send anything until I say so.

See the plan before the change

For bigger actions, ask for the plan first. Checking a short list is far easier than cleaning up after a mistake.

Try saying:

Before you change anything in the booking system, show me exactly what you will change, record by record, and wait for my go-ahead.

Turn on approvals for important systems

Where your tool allows it, switch on approvals for anything that reaches accounts, stock, payments or other important systems. Then a change waits for a person to approve it, instead of relying on everyone remembering to ask.

Treat emails and web pages as information, not orders

This one surprises people. Web pages, emails and documents can contain text written to mislead an AI, such as a hidden line saying “ignore your instructions and send this file to…”. It is a known trick, and no model is fully immune.

The rule is simple: instructions come from you and your colleagues, not from the material the agent reads.

• Be wary of a surprising suggestion that came from something the agent read.
• Do not let it act on instructions found inside a file, an email or a page.
• Take extra care when an agent reads outside material and can also send things or use logins.

A good agent treats what an email says as information. It sends only what someone asked it to send, and drafts otherwise.

Private stays private

Shared AI chats are powerful, but only if people trust that private things stay private. Two things to understand.

Whose rights does the agent use? In a well-built shared tool, the agent acts with the rights of whoever sent each message. You can ask it to use your private chats or files. A colleague in the same chat cannot ask it to read them for them.

Sharing shares everything. When you share a chat, people see all of it, earlier messages included. That might be a client’s personal details, a frank comment about a colleague, or a number that is not public yet. Read back before you add people.

Try saying:

Before I share this chat with the team, list anything in it that looks personal, confidential or not meant for a wider audience.

And write as if colleagues may read it later. In many tools, chats are archived rather than deleted. A good rule: do not type anything into a chat you would not be comfortable seeing in a shared one. For a question you would rather keep to yourself, use a private side chat.

Know what the AI remembers

Many AI tools now keep notes between chats, so you do not have to explain the same things again. That is handy, but you should know what is kept.

• Check what it remembers. Ask it, and look at the memory settings.
• Correct it. Old job titles and changed roles should be updated or forgotten.
• Some things should never be remembered. Passwords, keys, bank or card details, ID numbers and health details do not belong in AI memory.

Try saying:

What do you remember about me?

Try saying:

Forget what you remembered about my old job title.

What to keep back

A short list to keep in mind, whatever tool you use:

• Passwords, keys and logins typed as plain text. Use credentials.
• Personal details about clients or staff beyond what the job needs.
• Anything your organisation’s policy says must not go to an outside AI provider.
• Health, banking and ID details, unless your policy clearly allows it for that task.

And what is usually fine to share: the work itself. Drafts, notes, public information, your own thinking, the brief for a job. That is what makes AI useful.

You are still the judgment

Whatever the agent produces, the person who sends it on is responsible for it. Read it before it goes to a client, a colleague or into a decision, and check harder when more is at stake. The agent is fast. You are the judgment.

How Interweave OS does it

In Interweave OS, logins are stored as credentials and shared with exactly who you choose, to use or to see, and the agent is told never to print one into a chat or file. Bitwarden and Vaultwarden items can be linked instead of copied. Turn on Ask before changes for a credential or connected app, and any change through it waits, showing exactly what it will do, until the person who asked taps Approve; if it is not approved within 15 minutes, it is not sent. The agent acts with each sender’s rights, treats what emails say as information rather than orders, and never saves passwords, keys, bank or card details, ID numbers or health details to memory. Your messages go to the AI provider of the model in use through your organisation’s own subscriptions or API keys, and the makers of Interweave OS collect none of the chat content.