IT Admin AI Acceptable-Use Kit

The situation you are in

Somebody forwarded you an article. Or your director came back from a conference. Or a customer asked, in a security review, what your AI policy is. Now you own AI, on top of the device refresh, the identity migration, the audit remediation, and a help desk queue that does not care what year it is.

Meanwhile it is already happening. Your developers are pasting configs into chatbots. A meeting-notes bot is joining calls with a mailbox grant somebody clicked through eight months ago. Finance is uploading spreadsheets. Someone on your own team asked an assistant to write a cleanup script and ran it, and it worked, and nobody wrote that down anywhere. Two of your existing vendors shipped AI features into products you already license, without a new contract and without asking you.

You are not behind. Everyone is here. But the longer there is no written rule, the more the vendor's terms of service are your policy — and the worse the first incident goes, because the person who pasted the key knew it was wrong and had no reason to tell you.

What this kit is

A starter set. An eleven-chapter guide, a draft acceptable-use policy, a redaction standard, a local-model standard, a vendor questionnaire, and the operational templates that make a policy real instead of filed — written so one person can go from an inventory to a published policy in about thirty days of part-time work.

It is opinionated where opinions help. It says do not open with a ban, because a ban produces measurable non-compliance in a month and costs you the visibility you need. It says write the policy about information, not about tools, because tools change every quarter and information classes do not. It says stand up a local model, because a model that does not leave your network turns most of your hard policy questions into easy ones. It says publish a turnaround commitment for tool requests and hold it, because the request path is only real if waiting is cheaper than routing around you. And it says make self-reporting a mistake carry no consequence, in writing, because you would rather hear about the pasted credential from the person who pasted it than from a vendor's abuse report.

Where your organization reasonably differs, the templates leave room and the guide says which decisions are genuinely yours.

What is inside

• The guide. Eleven chapters, about 18,000 words: what your org is already doing and how to find it in a week; the data-and-destination matrix; redaction with worked examples; tiers and the request path; scripts and configs; runbooks from ticket threads; user communication; the local model as a policy answer; vendor vetting; incidents; and the 30-day rollout with a quarterly review.
• Fifteen templates. Four policy documents: the AI acceptable-use policy, the data classification and AI destination matrix, the local-model standard, and the AI incident response procedure. Three process documents: the tool request form, the approved-tool register, and the vendor security questionnaire in long and short form. Two redaction documents: the five-rule standard and a separate worked-examples file. Five documentation and communication templates: the runbook template, the ticket-to-runbook prompt set, the outage notice, the change announcement, and the user how-to. And the plan: a 30-day rollout, week by week, with a quarterly review on a standing six-item agenda.
• The free piece. The Redaction Guide — the five rules and three worked examples on one page, given away for an email address and useful on its own.
• START-HERE. What to do with one hour, one day, or one week, and a table telling you which file to bring to which meeting or moment.

Every template uses [BRACKETED PLACEHOLDERS] for organization-specific items and carries a short "how to adapt" note. They are plain markdown, so they paste into a word processor, a wiki, a ticketing system, or a policy platform without fighting formatting.

Who wrote it and why he can

Wayne Bridges, a public-sector solutions engineer who builds and runs AI agent systems daily.

Which matters here for a specific reason: the guidance on what these tools do with your data comes from operating them, not from reading about them. The redaction rules exist because of logs actually pasted and keys actually rotated. The local-model chapter exists because on-machine models run every day, and the honest list of what they are good enough for is a list of observed results rather than a vendor claim. The policy structure exists because a register that separates durable rules from volatile tool assignments is the only version of this that is still accurate a year later.

He is not a lawyer. That is stated at the top of every chapter that touches law, policy, HR, or procurement, and it is the reason the kit is built to be reviewed rather than adopted as-is.

What this is not

• Not legal advice. Your counsel and compliance owner review anything with contractual or regulatory weight. The chapters are written so you can brief them efficiently, not replace them.
• Not a product recommendation. No AI products are named except the open local-model runtimes you would install to follow chapter 8. The register you maintain is where products live; the rubric for judging them is what does not expire.
• Not a security program. It covers one domain. It assumes you already have acceptable use, change management, incident response, and third-party risk, and it tells you to hang the AI rules off those rather than build parallel ones.
• Not a finished policy. It is a draft about 80 percent of the way there. The last 20 percent is local: your classification scheme, your approval authority, your regulated data, your leadership's appetite.
• Not a training curriculum. There is a fifteen-minute staff session and a thirty-minute session for your own team in the rollout plan. That is the training, and it is deliberately that small.

Who should not buy this

• Organizations whose security team has already published an AI acceptable-use policy that legal reviewed and leadership adopted. You may still want the redaction guide, the local-model standard, and the questionnaire for embedded AI features, but you do not need the policy templates.
• Anyone looking for a list of approved AI tools. That list is yours to build, it is different for every organization, and it is stale in a quarter. The questionnaire and the register show you how to build and keep one.
• Anyone who needs the policy to be specific to a named regulatory regime out of the box. The kit treats regulated data as a class, tells you where your obligations plug in, and marks every place counsel needs to answer a question. If your environment is governed by one regime end to end, you want a specialist, not a starter kit.
• Anyone hoping a document will settle the argument for them. The kit makes the decisions explicit and gives you the draft; the ninety-minute classification meeting is still yours to run.

If you are the person who was handed AI on top of everything else and has been putting off the blank document, this is for you. Start with the inventory in chapter 1, bring one page to your manager, and you have a real conversation instead of another deferred one.