A Three-Zone Rule for What Goes Into AI Tools

It is 4:45 on a Friday. An analyst has a customer email to answer, a chatbot open in another tab, and a company policy that tells everyone to be careful with AI. Careful how? The email contains a name, an account number and a complaint about a signed contract. The analyst pauses, shrugs and pastes. This is the gap that AI data classification is meant to close: not a lack of good intentions, but a lack of a rule anyone can apply in ten seconds.

The short answer Most AI policy says be careful instead of saying what may go where. A three-zone rule fixes that. Green is public information, Amber is sanitised material, and Red is confidential IP and customer data. Staff sort the data, not the tools, and the whole rule fits on a card.

The policy nobody can apply

Read a typical AI policy and you will find sentences that are hard to disagree with. Use AI responsibly. Protect sensitive information. Follow the law. Each is sensible, and none tells a person at a keyboard what to do with the thing in front of them. Our post on spotting AI nonsense shows why human judgement still matters, but judgement needs a rule to lean on.

The failure is not that people ignore the policy. It is that the policy asks for a judgement call every single time, with no shared definition of sensitive. One person treats a client name as private. Another treats it as ordinary business chatter. Both believe they are following the rules.

A rule that works under time pressure has three properties. It is short enough to remember. It is concrete enough that two people reach the same answer. And it answers the question staff actually have, which is not "is this tool safe?" but "can I put this in?"

AI data classification: sort the data, not the tools

Most policies start with tools: this one is approved, that one is banned. The trouble is that tools change monthly, while the data your team handles stays largely the same.

So flip it. Ask people to classify the data first, then let the data decide which tool class applies. A published blog post can go almost anywhere, because the world can already read it. A signed customer contract cannot, whichever tool is open.

This has a practical benefit. When a new tool appears, you do not rewrite the policy. You decide which tool class it belongs to, and the existing rule covers it.

It also fits how people think. Nobody remembers a list of fifty tool names. Everyone can remember three colours and what each one means.

Green, Amber and Red defined

The Three-Zone Rule has three zones, and each has one clear meaning.

Green is public information. Anything already published or meant to be published. Any approved tool may be used.

Amber is sanitised or redacted material. Names, figures and identifiers have been removed so that the content no longer points to a person, client or secret. Only enterprise-approved tools may be used, meaning tools your organisation has formally approved for business use.

Red is confidential IP and customer data. No AI use at all, unless the work happens inside a certified controlled environment, meaning one that has been certified for that kind of data.

Exhibit 2.1: Each zone may flow only into its own tool class. Dashed lines show flows that are not allowed.

Note what Amber asks of people: the sanitising has to happen before the paste, not after. That is why the card needs a column for what must happen first.

Twelve everyday examples, sorted

The company below is hypothetical, and so are the examples. They show how the rule works in use.

Count them: 4 plus 5 plus 3 is 12. Red is 3 of the 12, or 25 percent. In this hypothetical company, a quarter of the everyday data types the team named should never touch an ordinary AI tool.

Exhibit 2.2: The twelve hypothetical data types counted by zone. Counts come from the list shown.

The exercise is useful even if your numbers differ. In this example Amber is the largest zone, and Amber is where good habits matter most, because sanitising takes real care.

Making AI data classification stick: the card, the owner, the review

A rule on a policy page is a rule nobody reads. Three small things turn it into a habit.

The card. Put the rule on one page: zone, what qualifies, which tools are allowed, what must happen first. Pin it where people work.

Exhibit 2.3: The Three-Zone Card. Small enough to print and pin up.

The owner. Name one person who answers "which zone is this?" questions and who keeps the examples list current. Without a named owner, edge cases get resolved by whoever is most confident.

The review. Every quarter, look at the questions that reached the owner. Repeated questions signal an example that belongs on the card.

If your team needs to understand why AI output can fail or mislead, the AI Limitation Awareness module is a short place to start. Our piece on human readiness as the missing guardrail makes the wider case.

This is a working rule for staff, not legal advice. Check your own regulatory obligations with qualified advisers.

The objection: it slows people down

It will, a little, at first. Sorting data into a zone takes a few seconds, and Amber takes longer because someone has to redact.

Weigh that against the alternative. Under a vague policy, every person already pauses, wonders and guesses. The three-zone rule moves that pause from anxious guessing to a quick sort. Green work, much of day to day writing, takes no extra time at all.

And for Red, slowing down is the purpose. If the cost of a single mistake is a leaked contract or exposed customer records, a short pause is cheap.

If the rule feels too slow in practice, that is feedback. Check whether the card is unclear, or whether a common Amber task needs a pre-approved redaction template.

What we believe, and one thing to do this week

We believe AI policy should tell people what to do, not just how to feel. Rules that fit on a card get used; rules that need interpretation get ignored.

This week, spend 20 minutes with your team. Pick ten pieces of data you handled in the last few days and sort each into Green, Amber or Red. Note every item where two people disagree. Those disagreements are what your card needs to settle.

Your next step The AI Limitation Awareness module helps you identify AI bias and failure points, manage risk and apply ethical judgment. It is a short way to give your team shared language before you roll out the card. Explore the AI Limitation Awareness module. The free Plan of Six guide is a good companion.

Skillement

Published 4 November 2026

Related reading from Skillement - Spotting AI Nonsense: Humans Do It Best!
Why people remain the best check on AI output. - Why Human Readiness is the Missing Guardrail in the SCAI Debate
Why human readiness belongs in any guardrail discussion. - The Thin Balance: Ethical Leadership in the Digital Age
A leadership view on balancing ethics and technology.

About Skillement

Skillement builds the instruments that make AI readiness measurable. Individuals can take the AI Quotient (AIQ) assessment and build skills through the Skillement Academy. Organisations use AIVROs, an operating system that ties AI readiness, workforce capability and EBITDA into one closed loop. The free Plan of Six guide shows how to move from a long list of AI ideas to six funded initiatives. Where a figure is hypothetical or directional, it is labelled as such.

Further reading is in the Skillement Insights library.

© 2026 Skillement. All rights reserved.