Appendix B. Self-check answers and explanations

Chapter 1

1-1. Reach of impact (for example, a notice sent to hundreds of customers), difficulty of reversal (transfers, sending or deletion), and time to detection (a calculation error discovered only through a complaint weeks later). If even one is high, the step needs human approval or rigorous review rather than automatic execution. A single risk score averages away these differences.

1-2. Processing time is time doing the work; waiting time is time waiting for the next person to start. AI mainly reduces processing time. Combining the two can overstate benefits in work dominated by waiting, or conceal the procedural changes actually needed, such as assignment frequency or approval chains.

1-3. Department-name classification suits rules because fixed-condition classification is accurate and easy to explain. Distinguishing complaints from inquiries suits AI because it requires contextual interpretation. Combine them by having AI classify the content, then rules route it to the responsible person.

1-4. Approval permits an action; verification checks whether the content is correct. Approval alone leads reviewers to click without checking correctness—approval fatigue and rubber-stamp review—letting errors pass while leaving responsibility with the approver.

1-5. 90 × 4 minutes = 360 minutes, or six hours daily. With only three hours available, half cannot be reviewed as planned. Possible adjustments include sampling low-risk cases, having AI show evidence locations to shorten each review, or narrowing automation to a reviewable volume such as 45 cases daily and handling the rest conventionally. Simply removing review is not an answer.

1-6. Monday morning is a scheduled-task trigger; reading meeting minutes from the shared drive requires a read-only connector; summarizing decisions is AI generation with a format defined in instructions; results go somewhere the team lead can see, such as a drive document or notification. The order is fixed, so an agent independently choosing steps is unnecessary. If sending is unnecessary, do not enable a sending tool.

1-7. Example: human review points (location, reviewer and backup coverage) and stop conditions. Without knowing who checks what and when to stop, a new owner may leave automation running unchanged or stop it entirely. Purpose and baseline, or excluded work and reasons, are also valid choices with comparable reasoning.

Chapter 2

2-1. Personal custom instructions apply generally across the user's conversations and are maintained by that user. Project instructions apply only within the project and are maintained by owners and editors; in OpenAI projects, they override global custom instructions. Team rules in personal settings produce different results, miss new members, and require everyone to edit separately when rules change.

2-2. Instructions: (A) source-document-name rule, (C) ask-for-date procedure, (E) tone rule. Knowledge: (B) opening-hours tables, (D) model answers. Instructions define behavior; knowledge supplies references. One or two short format examples can belong in instructions, but ten example answers are reference material and belong in knowledge. If (B) changes often, consider connecting the original instead of uploading a copy.

2-3. Example answer:

[Role] You guide employees on internal meeting-room use.
[Task] Explain booking, available hours and prohibitions based on the 'Meeting-room policy'.
[Context] Users are general employees who use rooms occasionally and often ask in a hurry.
[Format] One-line conclusion → no more than three procedural steps → supporting clause number.
[Exception handling] If a situation is not covered, do not guess; write "This is not covered by the policy," then
                     direct the user to the general affairs desk. Reason: incorrect guidance can conflict with other departments' bookings.

The key grading points are concrete actions instead of wishes such as “be kind” or “do not be wrong,” and reasons attached to exception handling.

2-4. RAG answers from selected chunks similar to the question, so it can miss material in exhaustive counts requiring every source to be inspected. Organize data into tables and process the full dataset with a spreadsheet or data analysis feature instead.

2-5. Ingestion: ask about an exact sentence unique to the file or check whether the file is readable as text. Retrieval: ask again using the source's terminology. Generation: compare cited evidence with the original for omitted conditions. The failed stage determines the remedy: material preparation, glossary enhancement or instruction revision.

2-6. Connected sources may reflect original changes, such as Drive files added to Gems. Uploaded copies remain fixed until someone replaces them. Even a “connection” may not sync in advance, depending on the product. Recording the distinction clarifies update methods and owners for each source and prevents abandoned outdated copies.

2-7. Normal: answer accurately with evidence. Exception: ask for missing information or hand off. Refusal: decline inaccessible information and guide to the proper route. Boundary: apply precedence to conflicting sources, reveal uncertainty and avoid invention.

Chapter 3

3-1. Just as your badge opens only permitted floors, a connector reaches only the connected person's source-system permissions. When many people use one fixed key, everyone gets that key's permissions and individual distinctions disappear. Use credentials restricted to what those members may access.

3-2. Authentication identifies whose account is connected, changed by reconnecting with another account. Access permissions determine what it reaches, changed by source-folder sharing or reduced requested scopes. Execution approval determines whether this action may proceed, changed by configuring the sending action to require confirmation each time. The key is that execution-approval changes leave access permissions unchanged.

3-3. The host is the employee's AI chat app. The client is the component it creates to connect to the calendar server. The server exposes calendar functions—tools such as lookup and creation, resources such as room lists—to the app. A host connecting to several servers has a client for each.

3-4. Excessive functionality: block unused tools and remove leftover test connections. Excessive permissions: use individual permissions and narrowly scoped shared keys. Excessive autonomy: require approval for writing, sending and deletion. Reducing any one helps, but reducing all three limits damage when one layer fails.

3-5. Any four or more of deliverable, completion criteria, scope, prohibited actions, stop conditions and reporting. Without stop conditions, agents may repeat blocked attempts, consume time and usage, try routes such as login or payment to reach the goal, or return results with accumulated errors.

3-6. Without seeing what they approve, people cannot verify content, so approval becomes a formality. Show target (recipient or changed record), content (amounts, dates, attachments), impact (external visibility and reversibility), and evidence (why the action is needed).

3-7. External materials may contain hidden instructions, and complete injection prevention is not yet established. Giving the same task a sending tool gives hidden instructions a route to transmit information. Separate reading from sending and let a person send to block that route. Other routes, such as images requesting external addresses, still exist, so this measure alone does not guarantee safety.

Chapter 4

4-1. It omits who (people), what (materials) and what they may do (actions), leaving the actual permitted scope unclear. Example: “Sales team members may view and download files in the Proposal Templates project, but may not edit instructions or invite others.”

4-2.

Two common misconceptions are that the lowest role cannot download files and that editors can remove members, when they can only invite them.

4-3. Example, conversation link: sharing one conversation from a private ChatGPT project shows only that conversation, not other conversations, files or instructions. For a shared-project conversation, recipients must join the project and can then see other content according to their role. Business-workspace links may include later messages too. If you chose another unit, check against the sharing-unit table. Scheduled task links reveal full instructions; exports do not sync with originals or inherit permissions.

4-4. Retention controls how long data remains; deletion removes particular conversations; training use controls model-improvement use; memory controls reference to past information in later conversations. Turning training off does not delete saved conversations (OpenAI). Deletion must be done separately, and complete removal from systems may take time.

4-5. It means deleting some personal information or replacing it with other values so people cannot be identified without separately held additional information. Any two: remove unnecessary fields such as names and contacts; replace names with “Customer A” and keep mappings outside the AI space; use aggregate counts by type instead of individual records.

4-6. AI-generated summaries, comparisons and quotations are derived information containing source content. Pasting internal outputs into external spaces can therefore have the same effect as sharing the original. Example rule: create external outputs in spaces containing only externally shareable sources, and have a person check internal outputs line by line before transfer.

4-7. Many settings only change future behavior, leaving existing shares or connections. Future-only examples: disabling Claude project sharing preserves existing individual and group shares (but organization-public projects become private, removing public-only access); ChatGPT Enterprise domain restrictions do not disconnect existing apps. Immediate irreversible example: shortening Claude Enterprise retention schedules data outside the new period for permanent deletion.

Chapter 5

5-1. Long lists bury important items, increase review time and encourage superficial checks. Meeting summaries need factual checks—decisions, owners and deadlines must match what was discussed in the meeting. Internal summaries that are not sent externally can omit action-target or promise categories. Sending the summary externally changes that judgment.

5-2. Minor: awkward wording. Significant: an incorrectly copied date. Critical: sending to the wrong customer. Example switching condition: return to full review if errors classified as significant or critical exceed the set rate for two consecutive weeks, or if any critical error occurs.

5-3. Judge the same output independently → discuss reasons for disagreements → record agreed criteria with examples in the checklist, repeating when reviewers change. Persistent disagreement means ambiguity; divide the item into smaller checks or replace judgment with verifiable facts.

5-4. Generated-draft denominator: 90 ÷ 200 = 45%. Reviewed-draft denominator: 90 ÷ 120 = 75%. Use 75% for quality because only reviewed cases have known quality, and report 60% review coverage (120 ÷ 200) alongside it to expose the unreviewed cases.

5-5. (A) Permissions and connections: expired authentication. (B) Generation: correct evidence found, but a condition omitted in interpretation. (C) Input: the changed form prevents reading required information. Treating (C) as an instruction problem and adding emphasis only increases the chance of invented information.

5-6. Savings per case: 10 − (1 + 4) = 5 minutes. 5 × 500 = 2,500 minutes, or 41 hours 40 minutes. Subtract ten maintenance hours to get about 31.7 hours monthly. Before calling it successful, check at least one of: quality remains at the previous level (error rate), rework time is included, the baseline was measured consistently, or tool costs.

5-7. Stop signals and the person authorized to stop; human takeover procedure, owner and forms; restart conditions (cause fixed, regression tests passed, responsible approval). Without resumption conditions, a rushed restart can repeat unfixed errors; without manual procedures, work accumulates during the stop.