Working with AI day to day

Eighty minutes, five sections. The first is short because Part IV did the heavy lifting; the two long ones are the brief and the verification section, because that is where the practical value and the practical risk both live.

Start with how common this already is, because the “should we allow it” conversation is usually two years late. Gallup’s workplace survey of 23,068 employed US adults, fielded in August 2025, found 45% had used AI at work at least a few times in the past year, up from 21% in the second quarter of 2023. Twenty-three percent use it a few times a week or more, double the 11% of two years earlier, and 10% use it daily. Those are self-reported figures from a US sample; treat them as scale, not precision, and expect the 2026 numbers to be higher. The more interesting finding is in the third box. Forty percent of employees said their organisation had not implemented AI, and 23% did not know whether it had. Put those together with the usage numbers and the picture is clear: a large share of use is individual, informal and untrained. People open a chat window, type what they would type into a search box, and judge the technology by what comes back. Some of them get excellent results, some get mush, and the difference looks random. It is not random. The rest of this section is about why.

Part IV’s single most important mental model carries the whole of this deck, so here it is again. A model has two sources of anything: what it learned in training, which is frozen and general, and what is in the context window on this call, which is specific and yours. Training gives it the shape of things: how an email to a client usually goes, what a project plan looks like, what a polite refusal sounds like. It gives it nothing about your client, your plan or your refusal. Those facts exist only if you put them in the window. When they are missing, the model does not stop and ask, unless it has been told to. It does what a next-token predictor does with a gap: fills it with the most plausible continuation. A plausible date. A plausible tone. A plausible name for the project. The output is fluent, which is why the gap-filling is invisible. This is why two colleagues with the same tool and the same task report opposite experiences. One of them typed a nine-word question. The other pasted the previous email, named the reader and said what a good reply would do. The model behaved identically in both cases. The windows were different. That is the good news in this deck: the model is not yours to change, but the window is entirely yours, and it is where almost all of the quality comes from.

The most useful analogy in this series, and it comes from a vendor’s documentation rather than a marketing deck. Anthropic’s prompting guide tells developers to “think of Claude as a brilliant but new employee who lacks context on your norms and workflows. The more precisely you explain what you want, the better the result.” Hold that picture. A good temp on their first morning reads quickly, writes well, knows what a board paper and a complaint letter look like, and will cheerfully attempt anything. What they do not have is you: your reader, your company, last week’s decisions, what “urgent” means on this floor, the document you keep referring to. They also, on day one, do not know when they are allowed to say “I don’t know”, so they tend to produce something confident instead. Everything you would do for that temp is what you should do for the model: brief them properly, hand them the file rather than describing it, show them an example of good, expect a first draft, and check the facts yourself. The analogy breaks in one important place, and it is worth saying out loud. The temp learns. By Tuesday they know your style; by Friday they know the client. The model does not learn from use (Part IV: nothing changes during inference). Every chat is day one again, unless the tool is keeping notes on your behalf, which is the subject of section five.

Here is the structure, and it is deliberately boring. A brief has a goal, an audience, a format, constraints, an example, and a description of what good looks like. Most prompts contain only the format: “write an email”, “summarise this”, “give me a plan”. The goal is the purpose behind the format, and the model cannot infer it; an email that gets a client to accept a delay is a different document from an email that informs them of one. The audience sets register and content: what the reader already knows, what they care about, how they will feel. The format is best shown rather than described; OpenAI’s guide puts it as “articulate the desired output format through examples” and warns against “fluffy” descriptions such as “fairly short”, preferring “a 3 to 5 sentence paragraph”. Constraints are the fixed points: the facts that must not change, the tone, the words to avoid, and both vendors advise saying what to do rather than what to avoid, because an instruction such as “do not use markdown” is weaker than “write in flowing prose paragraphs”. Examples are the highest-leverage part; Anthropic suggests three to five for consistent results, but even one previous good version transforms the output. Finally, what good looks like: the criteria you will judge by, and permission to say when it does not have enough to go on, which Anthropic’s documentation says “can drastically reduce false information”. The test at the bottom is Anthropic’s own: show your prompt to a colleague with no context. If they would be confused, the model is.

Put the two side by side and the mechanism from section one is visible. The nine-word prompt gives the model a format and nothing else. So it fills every gap with the most plausible content: a generic salutation, an apology, a vague reference to “unforeseen circumstances”, and quite possibly an invented new date, because delay emails usually contain one. It is not malfunctioning. It is continuing the text it was given. The brief on the right is six lines and takes about ninety seconds. It names the goal, which is not “inform” but “accept without escalating”. It names the reader and pastes her last email so the model can hear her register rather than guess it. It fixes the facts: the real cause, the real new date, the real offer. It specifies format in concrete terms, three paragraphs and under 120 words, which OpenAI’s guide would call the opposite of fluffy. It points at an example of the tone. And it gives the model an out: ask before drafting if anything is missing. In the illustrative run described on the slide, the second draft came back short, in her register, with the right dates, and it asked one question. That question is the brief working. The outputs are described rather than reproduced, and names and dates are invented; anyone can reproduce the pattern with their own delay email in two minutes, and should.

There is a small industry selling “prompt secrets”. The vendors publish theirs for free, and the two lists agree almost entirely. Be specific: Anthropic says “be specific about the output format and constraints you want”; OpenAI’s help-centre guide says “be specific, descriptive and as detailed as possible about the desired context, outcome, length, format, style”. Give examples: Anthropic suggests three to five, relevant and varied; OpenAI says start with none, add examples if the plain instruction fails, and fine-tune only as a last resort. Give it a role: Anthropic notes that even a single sentence in the system prompt helps; OpenAI’s equivalent advice is to put the instructions first and separate them clearly from the material. Let it think: Anthropic now prefers a general instruction such as “think thoroughly” over a hand-written step-by-step plan, and suggests asking the model to verify its answer against criteria before finishing; reasoning models (Part IV) do much of this by default. Specify output format by showing it, which OpenAI phrases as “articulate the desired output format through examples”. Say what to do rather than what to avoid; both guides use almost the same sentence. And give it an out: Anthropic’s hallucination guidance says explicitly giving permission to admit uncertainty “can drastically reduce false information”. OpenAI’s short guide does not include that one, which is why the slide says “do it anyway”. The wording of these pages changes every few months; the list has been stable for two years.

The highest-return habit in this deck costs nothing: give it the material. People describe documents to the model (“we have a returns policy that says roughly…”) when they could paste the policy. They summarise an email thread from memory when the thread is one click away. Each description is a lossy copy, and the model fills in the losses with plausible fiction. Paste the thread. Attach the PDF, and check it was actually read by asking it to quote the first line, because file handling fails quietly in some tools. For anything after the model’s knowledge cutoff, or anything on the web rather than in your files, turn on the search tool; the model is then reading current text rather than remembering stale patterns (Part IV). For long material, use the technique Anthropic documents for its own customers: ask the model to extract the exact passages relevant to the question first, then answer only from those passages. It makes the answer auditable and sharply reduces invention. The caveat is also from Part IV and it is real. More context is not automatically better. Chroma’s 2025 “Context Rot” report tested eighteen models and found reliability falling as input length grew, even on simple tasks, and that a single distracting passage could reduce accuracy. So paste what matters rather than everything, say which part matters, and put it near the start or the end. The slide’s rule is the whole of it: if you catch yourself describing a document to the model, stop, and paste the document.

Watch the people who get consistently good results and you notice they rarely accept the first answer, and rarely start again either. They treat the exchange as a draft loop. Five moves do most of the work. Ask for three versions rather than one: choosing between options is easier than specifying from nothing, and the spread between the three usually tells you what you actually wanted. Ask it to critique its own draft before you read it, and from a particular point of view: a sceptical client, a tired reader, a lawyer. Then tell it to fix what it found. Ask what it needs from you to do the job well; this converts silent gap-filling into explicit questions, which you then answer by pasting the material. Edit by instruction, the way you would mark up a human draft: keep this, rewrite that, say X here. And when the conversation has gone long and the model keeps drifting back to things you rejected, start a fresh chat carrying only the version you like, because every discarded draft is still in the window competing for attention (Part IV’s context rot). The vendor documentation gives these moves plain names. Anthropic’s hallucination guidance lists “iterative refinement”, using outputs as inputs for a follow-up that verifies or expands, and “best-of-N verification”, running the same prompt several times and comparing; disagreement between runs is a sign the model was guessing. None of this is a secret. It is how you would work with a draft from anyone.

The products multiply monthly, but there are really six kinds of tool, and the kind is set by two things: what it can see and what it can do. A chat assistant sees what you paste and does nothing but write; it is the workhorse for thinking, drafting and rewriting, and its failure mode is the one from section one: facts it was never given. A deep-research tool is a chat assistant allowed to use the web for minutes at a time; OpenAI’s launch note for its version in February 2025 said it “finds, analyzes, and synthesizes hundreds of online sources”, takes five to thirty minutes, and cites what it read, and in the same note that it “may struggle with distinguishing authoritative information from rumors” and “often fails to convey uncertainty accurately”. Open the citations. A coding agent is Part III’s loop pointed at a codebase: it reads, writes, runs and tests, and it needs Part III’s leash. A document or spreadsheet copilot lives inside the file, the mailbox or the sheet; it is only as good as what the permissions let it see, which is both its strength and its boundary. Voice is the same model with the checking step removed, good for thinking aloud and rehearsal, bad for facts. Image tools are for concepts and drafts; text inside images, real people, brands and anything you intend to publish need care. Pick by job shape. The logos are on the next slide and will be out of date by spring.

This is the one slide in the deck with product names on it, and it carries its date because several of these names will have changed by the time you read this. The grouping is the point, not the list. The four big chat assistants, ChatGPT, Claude, Gemini and Microsoft Copilot, each come in consumer and business tiers, and the tier matters more than the brand for a reason the next section explains. Deep research features now exist inside most of the chat products, with Perplexity built around the idea; all of them produce citations, and a citation is a claim until you open it. Coding agents are Part III’s loop with a keyboard; the names change fastest of all. Document and spreadsheet copilots are the ones most people will meet first, because they arrive inside Office or Workspace through the company licence, and they run under the permissions of the person using them, which is a question for IT rather than for the user. Voice and image are listed so nobody thinks they are a different technology; they are the same models with a different input or output. The practical instruction on the takeaway line is the only product advice in this deck: if your organisation has a business tier of any of these tools, use that one, not the free app on your phone. The reason is not quality. It is what happens to what you paste.

A second way to choose, independent of the product names: ask two questions about the job. Is it a one-off or does it repeat? And is the material already in your hands, or out in the world? A one-off job on your own material is the chat assistant’s home ground: paste, brief, iterate, done. A one-off job that needs the world’s material, such as what competitors charge or what changed in a regulation, is a deep-research job: let the tool read for twenty minutes, then open the citations, because the vendor’s own launch note says it may struggle to tell authoritative sources from rumour. The bottom row is where most people are wasting time without noticing. A job that repeats on your material, the weekly report, the standard client reply, the same kind of summary every Monday, should not be re-briefed every time; it belongs in a project, a custom instruction, or a saved brief, which is section five. And a job that repeats and reaches into outside systems, the inbox, the CRM, the web, is no longer a chat at all. It is an automation or an agent, with the test set and the leash from Part III. The line between the rows is the one to watch. The moment a task repeats, it has stopped being a prompting problem and become a setup problem, and setup is done once.

The question people ask is “can I trust it?”, and the honest answer is “for what?”. The ladder sorts tasks by what happens if the output is wrong, because that, not how confident the answer sounded, decides how much checking it needs. At the bottom, brainstorming: ideas, angles, questions. Nothing leaves the room, so a bad idea costs nothing and needs no check. Drafting: emails, outlines, first versions you will rewrite anyway. The check is simply to read all of it, which sounds obvious and is routinely skipped. Facts and numbers: every date, figure, quotation, citation and policy statement is a claim until you open the source, because Part IV explained that a model produces what a citation looks like, not a citation. Then the professional tier: legal, medical, financial and HR questions with consequences for a person. Here the model is good at drafting the questions to ask a professional and bad at being one, and the check is a qualified human. At the top, anything that leaves the organisation: to a client, a regulator, the public, a court. Your name is on it. The three stories on the next slide are all people who sent rung-five work with rung-two checking. The ladder is a teaching device, not a standard; the point is that “how much should I check?” has an answer, and the answer depends on the stakes.

Three stories, three rungs of the ladder, all sent with the wrong level of checking. Air Canada is from Part III. A website chatbot told a passenger he could apply for a bereavement fare after travelling, which was not the policy; when he claimed, the airline refused, and before the British Columbia Civil Resolution Tribunal in February 2024 it argued the chatbot was “a separate legal entity that is responsible for its own actions”. The tribunal member wrote that the airline was responsible for all information on its website, chatbot or not, and awarded $812. Mata v. Avianca is from Part IV and is the canonical verification failure. Lawyers filed a brief in the Southern District of New York citing cases that ChatGPT had produced; when one of them asked the tool whether the cases were real, it replied that they “indeed exist” and could be found in LexisNexis and Westlaw. The judge fined them $5,000 in June 2023 and found subjective bad faith. The lesson is precise: asking the model to check the model is not a check. Deloitte Australia is the fresh one. A 237-page review of a welfare compliance system, delivered to the Department of Employment and Workplace Relations for AU$440,000, contained references to papers that do not exist and a quotation attributed to a federal judge that he never gave. A Sydney University researcher, Chris Rudge, found the errors after publication and counted up to twenty. The revised version disclosed that Azure OpenAI had been used; Deloitte repaid the final instalment, which the department put at just over AU$97,000 in October 2025. The department said the substance and recommendations stood. Deloitte did not say whether the tool caused the errors; the correction and the disclosure make the inference hard to avoid.

It would be comforting to think Mata v. Avianca taught everyone the lesson in 2023. The data says otherwise. The French researcher Damien Charlotin maintains a public database of court decisions worldwide that address AI-fabricated material in filings; an American Bar Association Litigation Section article in June 2026, summarised by Covington, put the count at more than 1,600 and noted that it “climbs daily”. A ComplexDiscovery analysis republished by JD Supra in April 2026 tallied at least $145,000 in US sanctions for fabricated citations in the first quarter of 2026 alone, with individual penalties of $10,000 to $15,500 per lawyer becoming routine by March, and one day on which ten different courts flagged AI-fabricated filings. These are counts of what courts have caught and written up; the real number of unverified AI output in circulation is unknowable and larger. The lawyers are visible because courts publish their rulings; the equivalent failures in marketing copy, board papers and client reports mostly do not get a public docket. Deloitte’s is one that did, and the direct refund of just over AU$97,000 was the small part; the story ran in every business paper. Note what all of these have in common. None required a sophisticated attack or a subtle error. Each was a fluent paragraph that someone read, believed, and did not check against its source. The fix is the ladder on the slide before last, and it is boring, and it works.

The most common way to get into real trouble with these tools has nothing to do with hallucination. It is pasting something that should not have left the building into a tier of product that keeps it. The table is deliberately generic because the specifics move; here they are as published in October 2026. OpenAI’s data policy says that for its individual services “we may use your content to train our models”, with an opt-out in the privacy settings, while “by default, we do not train on any inputs or outputs from our products for business users, including ChatGPT Team, ChatGPT Enterprise, and the API”. Anthropic changed its consumer terms in September 2025: Free, Pro and Max users choose whether chats may be used for training, with five-year retention if they opt in and thirty days if not; Team, Enterprise, API and cloud customers are excluded. Google’s Gemini privacy page says human reviewers see a subset of conversations, tells users not to enter confidential information they would not want a reviewer to see, keeps reviewed conversations for up to three years, and lets users turn activity off. Microsoft’s enterprise data protection documentation states that Copilot prompts, responses and Microsoft Graph data “aren’t used to train foundation models” and sit under the same contractual terms as your email and SharePoint. The Samsung story is the cautionary one: in April 2023, per Korean press reports relayed by The Register and Bloomberg, engineers pasted source code and meeting notes into ChatGPT while trying to fix bugs and write minutes; within weeks the company banned generative AI tools on staff devices. The rule on the slide is the only one most people need: nothing you would not email to an outside contractor, unless your company’s plan and policy say otherwise.

Everything in this section reduces to one sentence: the output becomes yours the moment you use it. No client, court, regulator or manager accepts “the AI wrote it” as a defence, and two of the three stories earlier were organisations that tried. The ABA Litigation Section article on the 2026 sanctions wave put it in one line for lawyers that applies to everyone: “when we sign a filing, we make it our statement, not a machine’s.” The same is true of the email, the board paper and the quotation in the brochure. The second column is about honesty. The US Federal Trade Commission’s rule on fake reviews and testimonials, effective 21 October 2024 and covered in Part III, bans fake consumer reviews and testimonials including AI-generated ones; that is the hard legal floor. Above it, a norm is forming quickly: disclose when AI drafted something a reader would assume a person wrote, and especially when a client is paying for your judgement. Deloitte’s original report did not disclose the tool; the corrected one did, under pressure. The version people trust is the one that said so first. The third column is the minimum company policy, and it is four lines, not forty pages: which tools and tiers are approved and for what data; what must never be pasted; what must be checked, by whom, before it leaves the building; and who to ask. Part VIII does governance properly. For now the asymmetry on the takeaway line is the thing to remember: the tool has no name on the door, no licence to lose and no job to be fired from. You have all three.

The series convention: who does what, and what goes wrong. The model drafts, offers options, rewrites, summarises material you gave it, critiques its own work and asks the questions you should have thought of. You write the brief, hand over the material, read every word that leaves, open every source it cites and decide what gets pasted in the first place. The company buys the business tier so the pasting question has a safe answer, writes the four-line policy, names who checks the top two rungs of the ladder, and teaches people the brief, because Gallup’s numbers say most of them are currently teaching themselves. The three failure rows are the three you will actually meet. A confident citation, figure or quote that is wrong: the guardrail is to open the source before you use it, and to ask the model to quote the relevant passage so there is something to open; no source, no claim. Confidential material pasted into a consumer app: the guardrail is the business tier, or failing that the contractor rule, in one sentence, on the wall. An external document going out with “the AI wrote it” as the implicit excuse: the guardrail is the top rung of the ladder. Your name on it means your check on it. None of these guardrails costs money. All of them cost a few minutes, which is the honest price of using a tool that writes faster than you can read.

The weakness in the temp analogy was that the temp learns and the model does not. The fix is to write the induction pack once and have it handed over automatically. Four ways, in rising order of setup. First, a personal prompt library: a plain document with your five most common briefs, each with the reader, the format, the constraints and one pasted example of a good output. Copy, fill in today’s facts, go. It is vendor-neutral, shareable with the team, and it will still work when every product on the current board has been renamed. Second, projects and custom instructions. Most tools now let you store a standing brief and a set of reference files that are loaded into the window at the start of every chat in that context; Anthropic’s Projects, announced in June 2024 with a 200,000-token window per project and per-project instructions, are one example, and ChatGPT, Gemini and Copilot have their own versions. The generic idea is a reusable window. Third, memory features, which keep notes about you across chats and paste them back in; OpenAI’s version works from saved memories and from chat history, can be turned off in settings, and is bypassed by a temporary chat. Useful, and also a way for something sensitive to follow you into a later conversation, so know where the switch is. Fourth, recognise the moment a brief is being run every week on new inputs. That is no longer a chat; it is a workflow, and Part III’s rules apply: a test set, a leash, a log.

Five habits, each a direct consequence of a slide earlier in the deck, none requiring a purchase. Brief it like a temp: goal, reader, format, constraints, one example, an out; ninety seconds, and on paper the first time if that helps. Paste rather than describe, because the facts are in the window or they are invented, and ask it to quote the passage before it answers so you have something to check. Spend your effort on the second turn rather than on a second tool: three options, a self-critique, a question about what it needs, and a fresh chat carrying only the keeper when the conversation has gone long. Check by stakes, with the ladder: nothing for brainstorming, read every word of a draft, open the source for a fact, a qualified human for anything legal, medical, financial or HR, and your own name on anything external. And the contractor rule for what you paste: nothing you would not email to an outside contractor, unless your company’s plan and policy say otherwise, which means finding out what they say. Then, when all five are habits, write the five-brief library and stop re-typing the induction pack. The tool is a very capable stranger. Every one of these is how you would work with one.

For those who want the brief as a thing to paste rather than a slide to remember. The ordering follows the two vendor guides: OpenAI’s says to put instructions at the beginning and separate them from the material with clear markers; Anthropic’s says to be specific about format and constraints, to show examples, to give a role, and to tell the model what to do rather than what to avoid. The line “ask me before drafting; do not guess” is the “give it an out” technique from Anthropic’s hallucination guidance, which gives the model explicit permission to admit it lacks information. The closing line builds in the second turn from section two: two versions, then a self-critique. Store it wherever you will actually find it: a text file, a project’s custom instructions, a saved prompt. Most tasks need only four of the ten lines, and they are almost always goal, reader, material and example. The colour key is the series convention: gold for what the model judges, blue for what it reads, coral for what must not be invented.

Anthropic publishes a page for developers titled “Reduce hallucinations”. Four of its techniques translate directly into sentences a non-developer can type. Give the model permission to say it does not know; the page’s example is “If you’re unsure about any aspect or if the report lacks necessary information, say ‘I don’t have enough information to confidently assess this.’” For long material, which the page puts at over about 20,000 tokens, ask for word-for-word quotes first and an answer based only on those, with “No relevant quotes found” as the permitted fallback. Make it cite a passage for each claim and remove any claim it cannot support; the documented version marks the removed claims with empty brackets so the holes are visible. And restrict it to the provided material rather than its general knowledge, which combined with pasted sources or a search tool is the right setting for anything after the cutoff. Two further checks are ones you run rather than type: run the same prompt twice and compare, because disagreement is evidence of guessing, and where a tool shows its reasoning, read it when an answer looks wrong. The page’s own caveat should be quoted rather than softened: these techniques reduce hallucinations but “don’t eliminate them entirely”. Rung three of the ladder, open the source, still applies.