Before Anyone Pastes Client Context — a Minimum Team Agreement

The discovery workshop finished twenty minutes ago. The analyst has a messy page of notes: supplier names, a margin figure someone said aloud, a complaint about last year's warehouse cut-over. The write-up is due before stand-up. The tidy path is a paste into the generative tool already open in another tab.

That paste is the moment the organisation commits. Not the Acceptable Use page nobody opened since onboarding. Not the forty-page AI policy still in Legal's queue. The chat window.

Enterprise decks can wait. Five lines the team can recite under deadline pressure — or the unofficial norm writes itself by Friday.

The Paste Is the Commitment

Public large language models do not quietly fold your prompt into tomorrow's answers for strangers. The sharper risk is simpler: the query is visible to the provider, stored, and may be used to develop the service. Sensitive organisational content in that box is already outside the room.

There is a logical reason teams miss this. Policy is written for auditors and for future disputes. Paste behaviour is written in the ten seconds between "the notes are messy" and "stand-up starts in eight minutes." Those two clocks do not meet unless someone designs them to.

The gap most teams live in is ceremonial. A policy document exists. A ticket says "use the approved tool." Then the approved login fails, the free consumer chat is one click away, and a helpful colleague says "just this once." That is not a villain scene. It is how norms form when the operational floor is missing.

Practice tells the same story on every hot programme I have sat. The first person to paste under pressure becomes the template. The second person copies the template. By the end of the week, "we use the free model for notes" is culture — and the unread deck is still unread.

A long unread deck does not close that gap. Neither does a slogan without a path — "don't paste PII" with no redaction owner and no named channel produces silent pastes, not compliance. A short signed agreement can close it — if it names what must never leave, how to redact what might, who decides when unsure, which channel is allowed, and what happens after a paste.

The Five Lines — Minimum Team Agreement

Pin these next to the backlog. Sign them in a standup before the first programme paste. Legal can ratify later; the floor comes first.

• Never-paste classes. Name the programme-specific classes that must not enter any generative tool: client identifiers that map to contracts, credentials, regulated fields, and commercial figures the client treats as confidential. "Don't paste PII" is a slogan. A named list is a decision. Revisit the list when the client estate changes — a new regulated field in release two belongs on the page, not in someone's head.

• Redaction path. If a note can go in only after stripping, say who strips it and what "stripped" means for this estate — names to placeholders, figures removed, ticket IDs out. Without a path, people invent one under the deadline, or they paste anyway. The path should be shorter than the temptation: if redaction takes twenty minutes and the free paste takes twenty seconds, you have not designed a path — you have designed a bypass.

• Owner when unsure. Name a role — lead analyst, delivery lead, information owner — who decides edge cases before paste. Silence is not permission. The alternative is every person inventing policy alone in a chat window. Pick someone reachable during discovery hours, not a generic "raise to InfoSec" mailbox that replies next week. That owner is doing evaluative judgment — the kind that still needs a human name when someone asks who decided.

• Approved channel only. Write the tool (or tools) the programme may use when client context is involved, and what to do when that channel is down: wait, escalate, or work without the model — not "try the free one." Consumer and enterprise terms are not interchangeable; vendors publish different handling for API and business products versus public chat, and commercial Copilot commitments differ again on prompts and Graph data. The line is operational: which login, which tenant, which contract.

• Disclose and retain. If client context went in, say who is told and where the fact is recorded. No silent "just this once." Disclosure is how the team learns whether the never-paste list is wrong — or whether the approved channel is chronically broken. A one-line channel note beats a retrospective apology three sprints later.

Worked example — retail workshop notes

Same messy page: supplier names, a spoken margin, a warehouse cut-over complaint.

Never-paste first. Supplier legal names and the margin figure stay out. The complaint about cut-over timing can stay as a process note once names are gone — that is the kind of distinction a slogan never makes and a named list does.

Redaction next. The analyst replaces suppliers with A/B/C and deletes the percentage before any tool sees the text. Ten minutes of stripping beats an irreversible paste.

Owner when unsure: the spoken margin might be market gossip or client-confidential. The delivery lead decides before paste — not the analyst alone, and not "we'll ask Legal after stand-up."

Approved channel: programme Copilot or the contracted API workspace — not a personal free account on a phone between buildings.

Disclose: if someone already pasted the raw page yesterday, they say so in the channel. The team updates the never-paste list and the login ticket. Blame theatre teaches people to hide the next paste.

When the Approved Tool Is Down

This is where unread policy fails hardest. The ticket is open. The call is tomorrow. The free model will tidy the notes in thirty seconds.

Line four without line three is theatre. "Approved only" needs someone who can say "we wait" without sounding like they are blocking delivery. Line five matters afterward: silent pastes train the team that the agreement is optional.

The cost of inventing practice in the chat window is not only contractual exposure. It is epistemic: the team stops knowing what left the room. Next week's workshop inherits a habit nobody voted for.

The NCSC's framing is useful here without becoming the spine of the piece: let people experiment with these tools, but not by putting organisational data at risk. A downed approved channel is a process incident. It is not a licence to redefine the channel.

Regulators expect organisations to govern how personal data meets AI systems — risk assessment, accountability, measures that match the risk under AI and data protection guidance. Five lines are not a DPIA. They are the paste-time floor so the DPIA is not inventing practice after the fact.

Signing Without Theatre

Print one page. Read the five lines aloud once. Each person on the discovery pod initials. Pin the page where the team already looks — Confluence home, Miro frame, the shared channel topic.

Keep the ceremony boring on purpose. No launch email. No town-hall slide. The point is that every person who might paste has already said yes to the same five constraints. Once client context is allowed into an approved channel and a draft comes back fluent, red-team the draft before you put a name on it — that is a different hour from the paste agreement, and both matter.

Do not wait for the perfect enterprise framework. The first paste sets the norm. Waiting for Legal's final deck while discovery runs is how unofficial practice hardens — and how the forty-page document arrives to describe a reality it never constrained.

When Legal's deck does arrive, map it onto the five lines. If the deck adds classes or channels, update the one-pager. If it only restates principles the team already signed, leave the one-pager as the desk artifact and file the deck where auditors look.

The durable artifact is the agreement, not the essay around it. If you change only three things this week, name the never-paste classes, name the owner when unsure, and treat every paste of client context as a commitment the team can see.