Using Generative AI Tools

Authorization and Core Rules

Generative AI can accelerate drafting and brainstorming, but security is the priority. As discussed in GSA CIO 2104.1C, you must never use these tools unless they are explicitly authorized for your specific use case. Even with an approved platform, the rule is simple: you may only use generalized, non-sensitive data.

Strictly Prohibited Data

To protect the agency, certain categories of data are strictly off-limits for AI prompts. Personally Identifiable Information, such as employee names or IDs, must never be entered. This includes Controlled Unclassified Information, like proprietary vendor proposals or sensitive floor plans. Finally, avoid all non-public work data, including internal drafts and unreleased procurement details.

Acceptable Data Inputs

You can safely use AI for tasks involving high-level or public information. Transforming publicly available text, like published federal regulations, is fully compliant. You might also use it for abstract concepts, such as brainstorming general software methodologies. Drafting generic presentation outlines or checking the grammar of non-sensitive text are also excellent uses for authorized tools.

The Prompt Workflow

Before submitting any prompt, apply this rapid decision workflow. First, confirm that both the platform and your specific task are explicitly authorized. Next, strip out all real-world markers like project names, locations, and vendor identities. Finally, use the 'Public Billboard' test: would this prompt cause a breach if it appeared on a searchable internet forum tomorrow?

Lesson Summary

Let's recap the essentials of AI safety at GSA. Remember that explicit authorization is mandatory, and you must never input sensitive identifiers. Always frame your prompts using hypothetical scenarios and public references rather than internal operational data.

Prompt Sorting Activity

Now, put these rules into practice. You will see five potential prompts. Evaluate the data in each one and sort them into the correct category based on GSA policy. Correct. That decision aligns with the data guidelines in CIO 2104.1C. Not quite. Review the data categories again. Remember, any PII, CUI, or non-public work data must be rejected.