# AI Tool Approval Workflow Mini-Course

A free AI Studio by Jericho giveaway package for security awareness, GRC, AI governance, L&D, MSP, and vCISO teams.

Use this as a reviewable starter course for employees and managers who need a practical decision path before using a new AI tool at work. Replace placeholders with your approved AI tools, intake process, data classification terms, reporting path, and policy owner before publishing.

**Attribution landing page:** https://contentstudio.jerichosecurity.com/campaigns/course-giveaway-ai-tool-approval-workflow

**CTA for teams:** Start free at https://contentstudio.jerichosecurity.com/signup?lp=course-giveaway-ai-tool-approval-workflow&utm_source=owned&utm_medium=giveaway&utm_campaign=ai_tool_approval_workflow_course_giveaway&utm_content=micro_course_download&utm_term=ai_tool_approval_workflow

---

## Course snapshot

- **Title:** Before You Try That AI Tool: The Approval Workflow
- **Audience:** Employees evaluating AI tools, managers approving team workflows, security awareness leads, GRC and AI governance teams, L&D teams, MSPs, and vCISOs
- **Format:** 6-8 minute micro-course
- **Recommended delivery:** AI acceptable-use rollout, manager enablement, new-hire onboarding, procurement/security review refreshers, or remediation after unapproved AI tool-use patterns
- **Human review required:** Security owner, GRC/compliance owner, AI policy owner, procurement or vendor-risk owner, L&D/training owner, and legal/privacy reviewer if the course references regulated data, contracts, CUI, customer data, employee data, or vendor commitments
- **Primary learner decision:** Before using a new AI tool for work, pause and confirm whether the tool, data type, business purpose, account type, and approval path fit the organization’s policy.

## Learning objectives

By the end of this short course, learners should be able to:

1. Recognize when an AI tool needs approval before work use.
2. Identify the five checks that matter: tool, data, purpose, account, and output use.
3. Choose the approved intake or escalation path instead of improvising with a personal or public account.
4. Explain why speed, popularity, or a free trial does not replace security, privacy, procurement, and policy review.
5. Ask for help in a practical, non-shaming way when the right AI path is unclear.

## Opening lesson copy

AI tools can be genuinely useful. They can summarize notes, draft messages, create training outlines, translate rough ideas, and help teams move faster.

That usefulness is exactly why organizations need a clear approval workflow.

The safest question is not, “Is this tool impressive?” The practical question is: **Is this tool approved for this data, this purpose, this account, and this output?**

A tool may be acceptable for brainstorming public information but not for customer records. It may be acceptable with an enterprise account but not with a personal login. It may be acceptable for a generic draft but not for source code, security findings, contracts, employee records, controlled information, or confidential business plans.

When in doubt, do not test the boundary by pasting a small sample. Use **[INSERT AI TOOL INTAKE OR APPROVAL WORKFLOW]**, check **[INSERT AI ACCEPTABLE-USE POLICY LOCATION]**, or ask **[INSERT APPROVED CONTACT/CHANNEL]**.

The goal is not to block useful AI work. The goal is to make the safer path clear enough that people can move quickly without guessing.

## The five-check workflow

Before using a new AI tool at work, check:

1. **Tool:** Is this AI product, plugin, extension, or feature approved for work use?
2. **Data:** What information will you upload, paste, summarize, transcribe, or generate from?
3. **Purpose:** Are you using AI for brainstorming, drafting, analysis, automation, customer work, code, security review, or decision support?
4. **Account:** Are you using an approved work account, enterprise tenant, vendor contract, or personal/free account?
5. **Output:** Will the result be reviewed before it is sent, published, used with customers, used in security decisions, or stored in a system of record?

If any answer is unclear, pause and use the approved approval path.

## Scenario 1: The useful browser extension

You find a browser extension that summarizes long web pages and documents. A teammate says it saves time. You want to use it to summarize customer call notes and contract language.

**Decision point:** What should you do first?

A. Install it because browser extensions are low risk.

B. Use it only on a few examples to see if it works.

C. Check whether the extension, data type, account, and vendor terms are approved for work use.

D. Ask a teammate who already installed it to run the summary for you.

**Best answer:** C

**Teaching feedback:** Browser extensions can access information in ways that are easy to underestimate. Customer notes and contract language may require review before use with an AI tool. Asking a teammate to use the extension does not remove the approval requirement.

## Scenario 2: The manager’s shortcut

A manager wants to compare performance notes across several employees and asks a team member to upload a spreadsheet into a free AI tool. The spreadsheet includes names, departments, ratings, and comments.

**Decision point:** What is the safest next step?

A. Upload the file because the manager approved it.

B. Remove employee names and upload the spreadsheet.

C. Ask for guidance through the approved AI or data-handling process before using the tool.

D. Use a personal account so the company account is not involved.

**Best answer:** C

**Teaching feedback:** Manager approval is not the same as security, privacy, legal, or policy approval. Employee information can remain identifiable even after names are removed. Use the approved workflow before uploading or pasting the data.

## Scenario 3: The free trial for a client deliverable

A consultant wants to use a new AI presentation tool to draft a client training deck. The tool offers a free trial and asks for a project description, source notes, logo, and client details.

**Decision point:** Which question matters most before using the tool?

A. Does the free trial produce better slides than the current tool?

B. Is the tool approved for this client data, work purpose, and output review process?

C. Can the consultant delete the trial later?

D. Did another company mention the tool on LinkedIn?

**Best answer:** B

**Teaching feedback:** Free trials can still involve vendor terms, data handling, account ownership, and client confidentiality. Before using the tool for client work, confirm the approved workflow and review expectations.

## Knowledge check

### Question 1

Which situation should trigger the AI approval workflow?

- A. Brainstorming a generic lunch-and-learn title with no company details.
- B. Uploading customer support transcripts into a new AI summarization tool.
- C. Asking an approved internal tool to rewrite a public blog excerpt.
- D. Drafting a generic reminder to check the policy.

**Answer:** B

**Feedback:** Customer transcripts may include sensitive information and should be handled through the approved AI/data workflow before upload or summarization.

### Question 2

Why is a personal AI account usually not a safe workaround for work data?

- A. Personal accounts are always slower.
- B. Personal accounts may not have the organization’s controls, terms, logging, retention settings, or approval boundaries.
- C. Personal accounts cannot generate useful text.
- D. Personal accounts are safe if only one person uses them.

**Answer:** B

**Feedback:** Account type matters. An enterprise or approved work account may have different contractual, technical, and administrative controls than a personal/free account.

### Question 3

What should a learner do when they are not sure whether an AI use case is approved?

- A. Paste a small sample and see what happens.
- B. Ask a coworker to try it first.
- C. Use **[INSERT AI TOOL INTAKE OR APPROVAL WORKFLOW]** or contact **[INSERT APPROVED CONTACT/CHANNEL]**.
- D. Avoid all AI tools forever.

**Answer:** C

**Feedback:** Uncertainty is a workflow question, not a personal failure. The safest next step is to use the approved process and get guidance.

## Remediation note for follow-up

If a team is already using unapproved AI tools, keep the response practical and non-shaming:

- Clarify which tools are approved today.
- Explain which data types require extra review.
- Show the approved intake path.
- Give examples of safe, reviewable AI uses.
- Give examples that require redaction, approval, or a different workflow.
- Invite questions without treating curiosity as misconduct.

Avoid framing employees as reckless. Many risky AI behaviors come from useful intent plus unclear guardrails. Training should make the approved path easier to follow.

## LMS packaging notes

- Suggested seat time: 6-8 minutes.
- Suggested completion rule: view the lesson and answer knowledge-check questions.
- Include captions and transcript if converted into video or voiceover.
- Include a printable job aid: “Before using a new AI tool, check tool, data, purpose, account, and output.”
- For SCORM/xAPI export, include a clear lesson title, short description, quiz completion metadata, and review-owner notes.
- If this course supports compliance, privacy, vendor-risk, or AI governance work, document the source policy, approval workflow, and human review record alongside the LMS package.

## AI Studio by Jericho prompt to recreate or adapt

Paste this into AI Studio by Jericho and replace bracketed placeholders before generating:

> Create a 6-8 minute cybersecurity micro-course titled “Before You Try That AI Tool: The Approval Workflow.” Audience: employees and managers who use AI tools at work. Goal: teach learners to check tool, data, purpose, account, and output before using a new AI tool. Include three workplace scenarios, three quiz questions with teaching feedback, a non-shaming remediation note, captions/transcript guidance, LMS packaging notes, and a human review checklist. Use these placeholders: approved AI intake workflow = [INSERT WORKFLOW], approved AI policy = [INSERT POLICY LOCATION], approved contact = [INSERT CONTACT], approved tools = [INSERT TOOL LIST], restricted data categories = [INSERT DATA CATEGORIES]. Keep claims proof-safe. Do not promise compliance, breach prevention, or guaranteed behavior change. Mark assumptions for review.

## Human review checklist

Before publishing, confirm:

- The approved AI tool list and intake workflow are current.
- The data categories match policy and contractual obligations.
- The course does not imply legal advice or guarantee compliance.
- The scenarios fit the organization’s real workflows.
- The quiz feedback teaches the safer decision without shaming learners.
- Captions/transcripts and accessibility checks are ready if video or voiceover is used.
- LMS completion settings and reporting expectations are documented.

## Adaptation ideas

- **GRC/AI governance:** Add policy-source citations and approval evidence notes.
- **MSP/vCISO:** Replace placeholders for each client’s approved tools and escalation path.
- **Managers:** Emphasize that manager approval does not replace the official AI/data workflow.
- **L&D:** Pair this module with a one-page job aid and a short manager discussion guide.
- **Security awareness:** Use the same structure for post-incident or post-survey reinforcement.

## CTA

Use AI Studio by Jericho to turn this markdown starter into a reviewable course draft, quiz, voiceover, captions/transcript guidance, and LMS-ready export notes.

Start at: https://contentstudio.jerichosecurity.com/campaigns/course-giveaway-ai-tool-approval-workflow