Lesson 3 of 4 · about 5 min
Guardrails for IT support
When you finish, you can use AI in support work without leaking credentials, running unsafe commands or breaking policy.
Stuck? Ask the AI tutorWhat never goes into a chat box
Never paste passwords, recovery codes, API keys, private keys, tokens or remote access links. Do not paste screenshots that show them. Strip out usernames, device names, IP addresses and anything that maps your internal network. Attackers can use that map.
Also protect users. Tickets may contain personal details, medical or financial messages, or private files. Unless your employer has approved the tool for that data, describe the problem in general terms instead. Follow your organization's policy and, if you are unsure, ask your security lead.
Wrong or dangerous commands
Assistants can produce commands that look right but are wrong for your system version, or that do far more than asked, such as deleting a folder tree or opening a firewall port. Treat every command like advice from a stranger: read it, understand it, test it, and keep a way back.
Be careful with changes to security settings. Disabling antivirus, turning off updates or loosening permissions “just to test” can leave a door open. Make a change request when your process requires one, and note what you changed so another technician can reverse it.
Social engineering and verification
AI also helps attackers write convincing messages and imitate voices. A request to reset a manager's password because they are traveling and in a hurry is a classic trap. Verify identity through your normal process, using a number or channel you already trust, no matter how polished the message looks.
Do not let an AI tool make access decisions. It cannot confirm who is on the phone. You can use it to write a clear verification checklist, but you carry it out.
Disclosure, fairness and saying no
Follow your employer's rules on AI use and any customer contracts that limit it. If an AI wrote part of a knowledge article, review it as your own work, because users will rely on it. Where a customer chat bot is used, tell users they are talking to a bot and give an easy way to reach a person.
Be fair in how you help. Not everyone is comfortable with technology, speaks the same language, or has the same abilities. Use AI to simplify instructions and offer other formats. And say no, kindly, to shortcuts that break policy: “I cannot skip verification, but I can get this fixed quickly once it is done.”
Practice now
- Write a one-page 'safe to paste' list for your desk: three examples of safe descriptions and six things that never go into an AI tool.
- Ask an AI tool for a command to solve a simple task, then write down what each part does, what it changes, and how you would undo it.
Use any AI assistant you have. Do not paste private, client or patient information into it.
Check yourself
1. A message claims to be from a senior manager who needs an urgent password reset. What do you do?
2. Why can IP addresses and device names be risky to paste?
3. Who is responsible for a knowledge article an AI helped draft?
Ask the AI tutor
Ask anything about this lesson, in any language. The tutor is an AI: it can be wrong, and it never needs your personal details.
AI-drafted. Checked by an automated validator and a separate AI reviewer; a person has not read every lesson. Translations and tutor answers are AI-made. Found a mistake? Tell us. AI can be wrong. General information only, not professional advice. Not affiliated with any AI company named. Current University is not accredited.