Product · AI Guardrails Kit
Not another free policy PDF. Discover shadow AI, decide Conditional-first (Approved ≠ unrestricted), roll out employee rules, and keep a light quarterly cadence — with MSP delivery wrappers when you need repeatable client work.
Operational templates only. Not legal, compliance, or security advice.
The Business Pack is a full operating program, not a single template file. Everything is plain-English, editable, and cross-referenced so the policy, the checklist, and the employee guidance actually agree with each other.
Acceptable-use policy, data-classification quickstart, approval checklist, exception / temporary-use form, tool register, employee FAQ, do/don’t one-pager, and manager briefing. Change the names and the risk appetite; the structure is done.
A data-handling reference covering how major AI vendors treat inputs, retention, and training — plus six playbooks for public AI tools, Microsoft 365 Copilot, meeting bots, writing, research, and AI coding agents.
Approved-tool register, shadow-AI findings, incident and request logs, and a quarterly review tracker — as CSV and ready-to-open Excel workbooks, not screenshots.
Preflight checklist, Day-1 quick start, rollout checklist, and a sample 30-day calendar so the kit turns into an implemented program instead of a download.
$79 is often less than an hour of consulting time — and it covers the whole first draft of your AI program.One-time purchase. Use it across your organization. Edit it however you like.
Hand leadership a finished draft instead of a project estimate. You get enterprise-shaped structure without an enterprise GRC team behind it.
At typical billing rates the $299 pack pays for itself inside one engagement — client intro email, discovery agenda, scope language, and deliverables you can reuse across every account.
A one-time $79 line item gets you a defensible answer to “what are our AI rules?” without pulling anyone off revenue work for a month.
Both are one-time purchases with no seats, no subscription, and no per-document upsell. Everything listed below is in the download.
One-time · one organization · USD
One-time · practitioner license · USD
Local stub → thank-you page. Live email delivery when Gate 2 / 5B is wired (form-backend-wiring-notes-v1.md).
Each tool review produces a clear verdict, a risk rating, and an owner so nothing sits in limbo. Prefer Conditional for first intake; standing Approved is a later Promote (Approved ≠ unrestricted). This is the shape of the approved-tool register that ships with both packs.
| Tool | Use case | Data types | Risk | Controls needed | Decision |
|---|---|---|---|---|---|
| ChatGPT Team | Drafts, outlines, non-sensitive summaries | Public + non-sensitive Internal only | Medium | Business workspace; MFA; no connectors/uploads; human review | Approved |
| Microsoft 365 Copilot | Email, documents, consented meeting summary | Public + authorized internal (caution) | High | Permission audit; labels; meeting consent; no extra connectors | Conditional |
| Otter.ai Business | Meeting transcription | Customer calls (consented) | High | All-party consent; prohibited meeting types; retention ≤90d | Conditional |
| Fireflies.ai | Second meeting bot (rejected) | None for company work | High | Point to Otter Conditional; cancel unmanaged invites | Not approved |
| GitHub Copilot Business | Code assist in company repos | Source code (no secrets) | High | Business seats; secret scan; PR review; no agent modes | Conditional |
| Perplexity Pro Team | Public-web research notes | Public + non-sensitive Internal | Medium | Named users; no uploads; citation + human rewrite | Conditional |
| Google Gemini Business | Drafts / non-sensitive summaries (Workspace) | Public + non-sensitive Internal | Medium | Workspace Gemini; MFA; named OU; consumer Gemini banned | Conditional |
| Canva Magic Studio | Campaign concepts / social variations | Public + approved brand assets | Low | Brand kit only; human review before publish | Conditional |
| Personal / free AI accounts | Any company work | None | High | Employee notice; point to approved tools | Not approved |
Fictional ExampleCo register shape matching the worked sample approvals (Conditional-first: ChatGPT Conditional→Approved, Low→Conditional Canva, Conditional pilots, and Not approved; Gemini closes Under review). Risk ratings, controls, and verdicts are editable. Full register + sample completed artifacts ship in the download. Ungated sample gallery →
No. It is an operational starter kit — templates and workflows only. It does not certify SOC 2, HIPAA, ISO, GDPR, or any other framework. Review with legal, privacy, HR, security, and compliance stakeholders before adopting.
Free and high-authority templates usually give you one document. This kit sells the operating program: discovery, Conditional-first decisions, rollout, quarterly review, six tool playbooks, sixteen worked ExampleCo samples, and an MSP reuse pack. Preview three ungated sample excerpts →
Usually no. The kit is Conditional-first: prefer Conditionally approved for first intake / pilots — including Low band. Standing Approved is a later Promote when scope is stable and controls are live. Approved ≠ unrestricted. Low ≠ auto-Approve.
The Day-1 Quick-Start Guide is built for one first session: manager briefing, shadow-AI survey, and employee FAQ. A practical rollout can be underway within a week. The sample 30-day calendar is there if you want a fuller path.
Business Pack ($79) is complete for one organization. MSP / Consultant Pack ($299) adds client pitch and delivery materials for practitioners who reuse the kit across accounts. Internal-only buyers do not need the MSP pack.
Yes — that is what the MSP pack is for. It includes a client readiness questionnaire, pitch one-pager, QBR slide outline, follow-on opportunity map, intro email, discovery agenda, scope language, handoff checklist, quarterly review prompts, and a practitioner license for client engagements (not for reselling the source kit as a product).
The templates are a starting point, not a substitute for sector-specific compliance review. They are aimed at SMBs and IT teams that need practical guardrails, not an enterprise GRC program.
No. It helps teams enable AI with clear rules instead of pretending shadow AI is not already happening.