Search & explore

• Level L05
• T12
• 19 min read

Find every AI system your team uses, including the unofficial ones, and keep one inventory with a risk tier, a responsible person and stand-in, the data touched and who is trained. Link the proof an auditor asks for, decide which uses shouldn't exist, and test the handover without you.

Matching textT12-L05 · Security, privacy & governance · Level 5 Operator · 21-minute read, plus 3 hours of doing Keep One List of Every AI System Your Team Runs, and Make It Survive You Four answers

• Level L04
• T12
• 20 min read

Before real records reach a self-hosted assistant or workflow, check it from the outside in five steps, give it a service account that can only do its job, keep secrets out of files and Git, limit where it can send data, and prove a restore works, keys included. Every finding gets a fix, a date and IT's signature.

Matching textT12-L04 · Security, privacy & governance · Level 4 Integrator · 22-minute read, plus 3 hours of doing Lock Down a Self-Hosted AI Service Before Real Data Goes In Real data is waiting In a

• Level L03
• T12
• 22 min read

Before an n8n workflow runs without you, write its one-page operating rule and make the build obey it: a credential that can't do what the rule forbids, hard limits on items, time and model spend, a test set with known answers, and a deputy who can stop it without you.

Matching textT12-L03 · Security, privacy & governance · Level 3 Builder · 16-minute read, plus 3 hours of doing Give an Unattended Workflow Limits and a Stop a Colleague Can Use The list was empty, and

• youtube

Recognise indirect prompt injection in material an agent reads. Trap recognition only; not anonymisation or disclosure.

Matching textT12-L02: See how material an agent reads can redirect its task, so you can recognise instructions disguised as source content. Recognition does not guarantee prevention and does not replace anonymisation…

• youtube

Start governance with an inventory and connect it to risk and monitoring. General governance, not current EU legal advice or deputy-drill proof.

Matching textT12-L05: Learn how an AI inventory connects each system to risk assessment, documentation and continuing oversight. The fictional hiring example is not current legal advice or proof of deputy…

• youtube

Inspect secret-scanning findings and investigate active credentials. GitHub rather than gitleaks; entitlement varies; clean scan not proof of absence; exposed credentials need rotation.

Matching textT12-L04: Watch 4:50–16:00 for enabling secret scanning, inspecting findings and checking credential activity; 19:32 adds push protection. GitHub features differ from the book's local gitleaks…

One-page diagram to use with T12-L01, "Decide What You May Paste Into AI at Work".

One-page diagram to use with T12-L01, "Decide What You May Paste Into AI at Work", and 1 more book.

One-page diagram to use with T12-L05, "Keep One List of Every AI System Your Team Runs, and Make It Survive You", and 1 more book.