Using AI safely at work
You prevent data leaks, prompt injection and excessive tool permissions in AI tools, and prepare a usage policy that fits your organisation.
Level 201 · 21 lessons · 18 practice labs
Lessons
Understanding AI
- How generative AI works, briefly and plainly: With a simple analogy, you can explain how language models produce text and why they are sometimes confidently wrong.
- AI at work: chat, assistants and agents: You can tell the different risks of a chat tool, an embedded assistant and an agent that takes actions on its own.
- A map of AI risks: You gather privacy, accuracy, security, copyright and bias risks into one map and prioritise them for your organisation.
- Quick task: a team's AI usage inventory
Data and privacy
- Data leakage through prompts: what never goes in: You apply rules that keep customer, staff, source code and confidential data out of prompts.
- Which tool is allowed for which data class: You can build a simple table matching the organisation’s data classes to approved AI tools.
- Provider terms: retention, training use and region: You check an AI service’s terms on data retention, use for model training and where data is processed.
- Shadow AI: spotting unapproved tools: You spot AI tools staff use without approval and offer a safe alternative instead of a blanket ban.
- Quick task: strip sensitive data from a prompt
Model and agent risks
- Prompt injection: hidden instructions and protection: You understand how instructions hidden in documents, emails or web pages can steer an assistant, and choose limiting controls.
- Made-up output and the habit of verifying: You independently check facts, sources and figures from AI before using them in important decisions.
- Agent and tool permissions: least privilege, human approval: You give an AI agent only the access it needs and require human approval for irreversible actions.
- Using AI-written code safely: You never use AI-suggested code or packages without review, testing and a licence check.
- Process controls against AI-assisted fraud: You design process controls such as call-backs, dual approval and code words against faked voices and video.
- Quick task: inspect a document with hidden instructions
Governance and policy
- Regulation and standards: EU AI Act, NIST AI RMF, ISO/IEC 42001: You can summarise the duties that the main AI laws and standards place on an organisation.
- Reviewing risk with the OWASP Top 10 for LLM applications: You review an in-house AI application against the OWASP LLM list and identify missing controls.
- Approving a new AI tool: You run an approval process for an AI tool covering security, privacy and legal questions.
- The parts of an AI acceptable use policy: You can build a policy outline covering approved tools, forbidden data, verification, accountability and reporting.
- Logging and monitoring AI use: You record AI tool use in a privacy-respecting way and notice unusual activity.
- Capstone: assess a department’s AI use: You examine a fictional marketing team’s AI tools, data flows and risks and write a recommendations report.
Practice labs
- Sort the kinds of AI use: Classify twelve work examples as chat, assistant or autonomous agent use.
- Build the team's AI usage inventory: From a marketing team's survey answers, build a usage inventory with tool, purpose, data type and approval status.
- Place each use on the risk map: Assess ten AI uses at Göktaşı Yazılım for data leakage, wrong output, permissions and legal risk and pick the three riskiest.
- Mark what must not be in the prompt: Mark the parts of six sample prompts that contain personal data, passwords, customer names and trade secrets.
- Strip sensitive data from a prompt: Rewrite a prompt containing a customer complaint so it stays useful but carries no personal or confidential information.
- Sanitise a log before sharing: Find and mask the keys, emails and internal addresses in a two-hundred-line application log that will be shared for debugging.
- Match the allowed tool to the data class: Using the given permission table, write which tool may be used for ten tasks, or that none may.
- Read the provider terms: From the terms summaries of three fictional AI services, produce a comparison table of retention, training use and data region.
- Find shadow AI in the records: From a proxy log and an expense export, report the unapproved AI tools, the teams using them and the data volume.
- Find the hidden instruction: Find the instructions hidden in white text, comments and metadata fields of a document.
- Verify made-up output: Compare ten claims in an AI-written summary with the source document and mark them true, false or unsupported.
- Design safeguards for a summarising workflow: Write the safeguards at input, permission and output stages so an assistant that summarises incoming email is not steered by hidden instructions.
- Trim the agent's permissions: Mark which of ten permissions granted to a calendar assistant are not needed for its task.
- Review AI-written code: In a short AI-written script, find the hard-coded password, the unvalidated input and the non-existent package and propose fixes.
- Decide where a human must approve: For an invoice-processing agent's workflow, write the approval rules and limits for payment, supplier change and outbound email steps.
- Put each clause under its heading: Place fifteen rules under the scope, permitted use, prohibited data and responsibility headings of an AI acceptable use policy.
- Assess a new tool with the approval form: Assess a meeting-notes tool request against data, provider, access and logging criteria and decide approve, approve with conditions or reject.
- Assess a department's AI use: Assess the usage records of Yelkovan Bankası's customer service unit against the policy and the LLM risk list and write a findings report.
About this course
You prevent data leaks, prompt injection and excessive tool permissions in AI tools, and prepare a usage policy that fits your organisation.
What you will learn
- Understanding AI
- Data and privacy
- Model and agent risks
- Governance and policy
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.