Policy rules even when the tool allows it

A strategy analyst has to finish a confidential presentation on a possible acquisition by Monday. The company uses Claude through an Enterprise workspace administered by IT, and its AI policy says company information may only be used there. Because she changed teams, her access will only be ready on Thursday. At home she has a personal Claude account. It is the same product. Why not use it over the weekend?

Because the policy does not say “use Claude.” It says where and how.

Being able to does not mean you should

The tool does many things that your organization’s policy may restrict. What defines what is allowed is the policy, not what the button lets you do. Policies usually set three things:

• Where information is used: an approved workspace, with the configuration, controls and terms the organization negotiated and administers. A personal account, even of the same product, sits outside those controls.
• What data may go in (covered in the sensitive data lesson).
• What must be done with the result: reviews, approvals or an AI disclosure on external content.

The three shortcuts the exam tests

“It’s urgent.” A deadline does not suspend the policy. If approved access is not there, you ask IT to speed it up or work without the tool until it is. Removing the company name from the slides or deleting the conversations afterwards does not change the fact that the information left the approved workspace.

“I’ve edited it so much it’s mine.” A communications specialist drafted a press release with Claude and then rewrote it for two hours. Her company’s governance standard requires the disclosure on all external content drafted with AI assistance, regardless of how much it was edited. So the disclosure goes in. If the PR agency asks for a “clean” version, the rule is explained to them. Asking Claude whether the text “sounds like AI” is not a criterion: the policy is not about how it sounds, it is about how it was made.

“I’ll ask later.” Publishing and consulting the governance team the next day reverses the order. If the policy is unclear for your case, you ask before.

How to apply it

Situation	What to do
The policy requires an approved workspace and you do not have access yet	Ask for access to be sped up; do not use personal accounts
The policy requires an AI disclosure	Include it, even if the text was heavily edited
A third party (agency, client) asks to skip a requirement	Explain the rule; the requirement stays
It is unclear whether your case falls under the policy	Ask whoever administers it before acting
The policy seems out of date to you	Propose the change through the formal channel; meanwhile, follow it

The typical traps

• “It’s the same product, so the personal account is fine.”
• Using the personal account but “anonymizing” the company name.
• Deleting the conversations as if that undid the use.
• Deciding yourself that the rule no longer applies because the text was edited.
• Letting Claude judge whether the disclosure is needed.
• Complying after publishing.

On the exam

If the scenario sets out a clear policy and a reason to skip it (deadline, editing, a third party’s request), the answer follows the policy and solves the obstacle through the formal route: request access, include the disclosure, explain the rule. Rule out the options that look for an “almost equivalent” shortcut, the ones that erase traces and the ones that consult when it is already too late.