Decision inputs
Facts that change the policy answer
For this request, user behaviour, preferences and available content is the input boundary and ranked recommendations is the output boundary. A useful check makes both explicit.
- 1Task and owner
- Personalisation product manager wants to personalise product recommendations. The policy check should identify who can approve, correct or withdraw ranked recommendations.
- 2Information involved
- User behaviour, preferences and available content. The classification must cover what the tool can retrieve as well as what the requester types.
- 3Tool and account
- An approved company account. The request should identify the exact account because product-level approval leaves important controls unknown.
- 4Intended result
- The expected result is ranked recommendations. The policy needs to know what happens after generation, including publication, communication and automated use.
- 5Consequence if it is wrong
- Profiling can create sensitive inferences or trap users in a narrow experience. That risk sets the level of review and the person who should receive an exception.
- 6Human review
- product and privacy owners should inspect, change, reject or stop the result. Their role should include checking source facts, correcting errors and refusing the proposed use.
Possible policy routes
The task name alone cannot decide it.
A published workplace policy can return different answers for the same task. These are the practical branches worth encoding.
A routine policy route may be possible
The least restrictive path starts only after the exact account is approved, only the minimum user behaviour information is used, ranked recommendations remains within the stated purpose, and product and privacy owners reviews it before use.
Approval may be required
Pause the ordinary route whenever the account or data handling is uncertain, profiling can create sensitive inferences or trap users in a narrow experience, or ranked recommendations reaches people or systems beyond the requester’s authority.
The request may need to stop or change
The company may need a safer design when restricted information would enter an unapproved service, the output would act before product and privacy owners can intervene, or limit data, let users influence personalisation and monitor harmful outcomes cannot be maintained. Consider less information, a controlled account or a non-AI process.
Request checklist
Questions to ask before using the tool
- 01
Will personalise product recommendations run inside the approved company environment from start to finish?
- 02
Could user behaviour, preferences and available content be reduced to a short de-identified extract?
- 03
Could someone treat ranked recommendations as final even though it was generated as assistance?
- 04
Can product and privacy owners inspect the complete result and its source before reliance?
- 05
Which change in tool, data, purpose or impact would require a fresh request?
Worked request
What the employee should submit
This example supplies decision facts without pasting the underlying material into the approval record.
- requester
- personalisation product manager
- task
- Use AI to personalise product recommendations.
- information
- user behaviour, preferences and available content
- tool
- An approved company account
- frequency
- Recurring work
- region
- Where the work and affected people are located
- purpose
- Analyse
- impact
- Personalised user experience
- review
- Complete human review
- owner
- product and privacy owners
Useful safeguards
Controls that fit this request
- ✓
Limit data, let users influence personalisation and monitor harmful outcomes
- ✓
Reduce user behaviour, preferences and available content to the smallest useful extract and remove fields unrelated to ranked recommendations.
- ✓
Keep the use within analyse and run another check if the audience, tool or intended effect changes.
- ✓
Record the request and reviewer without copying unnecessary parts of user behaviour, preferences and available content into the audit trail.
Questions people ask
About this AI use
Is using AI to personalise product recommendations automatically allowed?
Treat this as a request pattern. The authoritative answer comes from the current company policy and the employee’s completed submission.
When is the request detailed enough to decide?
Describe ranked recommendations, identify user behaviour, preferences and available content, name the exact tool and account, explain who will receive or rely on the output, and state how product and privacy owners will review it.
Which evidence makes the answer reproducible?
Record the request and reviewer without copying unnecessary parts of user behaviour, preferences and available content into the audit trail. A classification and controlled reference may be enough when copying user behaviour, preferences and available content would create unnecessary risk.