Module 11 project: Your AI Use Policy and Security Review

Write the one-page AI use policy for your business and apply the security checklist to every agent, skill, command and routine you have built in this course. You end with documents you could hand to a client, an insurer or a new employee tomorrow.

1Configure permission rules in .claude/settings.json: allow the safe, ask for the sensitive, deny the dangerous.

2Map the personal data your agents touch and create minimised versions where possible.

3Scan for exposed secrets, move them to a password manager and rotate any that were exposed.

4Complete the Human-in-the-Loop Approval Matrix for your business.

5Add a self-check and a sampling rate to your three most important skills.

6Draft the one-page AI use policy with Claude and review every line yourself.

7Run the Agent Security Checklist on every agent and routine and fix the failures.

Deliverable

A one-page AI use policy, a completed approval matrix and a security checklist with every item passed or consciously accepted, covering all agents and routines built so far.

Done when

Deny rules block secret files, destructive commands and publishing.
No password, key or token remains in any file the agent can read.
Every send, pay, delete and publish action has a named approver.
The policy fits on one page and a new employee could follow it.
Every checklist failure is fixed or written down as an accepted risk with a date to revisit.

Which permission mode should you use for an unattended scheduled routine?

dontAsk denies anything not pre-approved, so an unattended run cannot do more than you allowed.

In permission rules, what happens when an action matches both an allow rule and a deny rule?

Rules are evaluated deny first, then ask, then allow. Deny always wins, in every mode.

You pasted an API key into a chat last month and nothing happened. What should you do?

A secret that has been in a conversation should be treated as exposed. Rotation is quick and removes the risk.

Which of these should always require a human approval?

Anything that spends money, is irreversible or is visible to customers needs a person, especially above a value limit.

Why use a separate reviewer session or subagent to check important work?

Fresh eyes with no knowledge of how the work was produced catch mistakes the author tends to miss.

MDAI Use Policy Template (1 page)Template MDAgent Security ChecklistChecklist CSVHuman-in-the-Loop Approval MatrixWorksheet