The rule that cannot live in memory
Your function is adopting AI faster than any survey predicted. SHRM's 2025 Talent Trends survey — 2,040 HR professionals — put AI use at 43% of organizations, up from 26% in a single year, with recruiting leading: 66% of AI-using recruiters draft job descriptions with it, 44% screen resumes with it, and 89% say it saves time. You've probably already used it this week, for the JD you didn't want to write from the last posting's corpse.
Here's what makes HR different from every other desk in the company doing the same thing: your inbox is where the protected data lives. An accommodation request with a diagnosis attached. Investigation notes from the thing in the warehouse. A background-check report the FCRA has opinions about. The candidate file with a date of birth in it. Marketing can paste their whole campaign brief into a chatbot and the worst case is embarrassment. Your worst case has a statute number.
So the people function runs on one rule that outranks every workflow in this chapter:
No personal employee data in prompts. Not names tied to issues, not medical information, not employee-relations material. Ever.
The problem with that rule is where teams keep it: in memory. It gets announced in a team meeting, lands in a slide, and holds beautifully until the Thursday when three reqs are open, open enrollment starts Monday, and someone pastes an FMLA letter into a chatbot because summarizing it by hand felt slow. Rules held in willpower fail exactly when the workload is heaviest — which in HR is always.
Rules held in code don't have Thursdays. A gate script reads the payload before anything is sent, checks it against a never-list, and returns BLOCK with a reason. It isn't smarter than you. It's just never tired, never behind on reqs, and never sure that "just this once" is fine.
This lesson builds that gate. First the firewall as a data structure — what may enter a prompt, what never does — then the scanner, then the failure mode where a gate checks some categories and quietly waves the rest through. By the checkpoint you'll have a prompt_gate() that audits a batch of real-shaped payloads and tells you what it stopped.
One category gets special handling: employee relations takes nothing, not even a summarization pass. That's step six, and it has no exceptions on purpose.