Chapter 5 · Practice and Capstone
Capstone, Cheat Sheet and What's Next: Your Responsible-AI Decision File
- Page 22 of 22
- 15 min read
This is the last page of the Beginner tutorial. You now have a method (the eight-step decision pattern), a set of principles, and practice from the lab. The capstone turns them into something you will keep and use: a short policy for how you will use AI in your studies, work or business. The page also gives you a one-page cheat sheet, a glossary, a look at what comes next, and a note on keeping your judgement current.
Nothing here is legal advice. The policy you write is your own commitment, not a legal document. It does not replace the rules of your school, employer, clients or country.
What you will learn
- How to define a policy's scope and review date, shown with a worked example.
- How to build the capstone, a Personal and Workplace AI-Use Policy, in ten milestones and test it against an acceptance checklist.
- A one-page cheat sheet that gathers the tutorial's checks, and a glossary of the terms you have met.
- What the Advanced tutorial and the Level 1 paths add, and how to keep your judgement current when rules and tools change.
The capstone: a Personal and Workplace AI-Use Policy
Deliverable. A practical one- or two-page policy explaining how you will use AI responsibly in your studies, work or business. Pick one context: student, teacher, freelancer, employee or small-business owner. Use your lab sheets (Practice Lab: Everyday Responsible-AI Decisions with Scenario Cards) and your commitment from Rules, Uncertainty and Responsible Decisions: Finding What Applies to You as raw material.
| # | Milestone | What to produce | Where it was taught |
|---|---|---|---|
| 1 | Choose a context | One context and its real rules (school, employer, client contract). | Everyday AI Ethics: Who Benefits and Who Could Be Harmed |
| 2 | List common AI uses and affected people | A table of 6 to 10 uses; for each, users, non-users, bystanders. | Same page; Decisions, Responsibility and Dilemmas in Everyday AI Use |
| 3 | Classify by harm, reversibility and review need | Low, medium or high for each use, with the worst realistic error and who bears it. | Safety, Misuse and Sensitive Topics: Health, Money, Self-Harm and Harassment |
| 4 | Define permitted, restricted and prohibited uses | Three lists, each use in one list. | Policies, Vendors, Records and Incidents: Responsible AI in a Small Team |
| 5 | Write disclosure and authorship rules | When you say AI helped, to whom, in what words; who is the author. | Learning, Integrity and Disclosure: Using AI in Study and Assessment; Work, Clients and Jobs: Using AI Responsibly Where You Are Paid to Decide |
| 6 | Set privacy, copyright and source-checking rules | What you never paste; licence and credit checks; what you verify. | Privacy, Consent and Data Use: What You Share with an AI Tool; Copyright, Licences and Attribution: Using AI Output and Source Material |
| 7 | Create an escalation route | Whom you ask when a case is high-stakes or unclear; a human contact. | Transparency, Explanation and Accountability: Who Answers for an AI Decision |
| 8 | Test against five hypothetical scenarios | Five invented cards; for each, the line of the policy that decides it. | Practice Lab (H2) |
| 9 | Revise from the results | The changes you made, with dates. | Same |
| 10 | Present and defend to a peer | Explain it as you would to someone who disagrees; note the questions you could not answer. | Rules, Uncertainty and Responsible Decisions: Finding What Applies to You |
Acceptance checklist. Your capstone is ready when every item is true and written on the page:
- Scope and intended users are defined.
- Low-risk assistance is separated from high-impact decisions.
- Affected people and plausible harms are identified.
- Disclosure, authorship and attribution are covered.
- Privacy and data-use expectations are covered.
- Human-review and escalation rules are included.
- A way to raise concerns or appeal a decision is included.
- Uncertainty and exceptions are addressed.
- At least five scenario tests are passed, and the results are recorded.
- There is a review date and an owner for updates.
A strong policy has several defensible forms. A reviewer should judge whether the choices are reasoned and whether the policy gives different answers to different risks, not whether it matches the reviewer's opinion.
Defining a policy, its scope and its review date: a worked example
Two parts of a policy are easy to skip and cause most trouble later: scope (what and who it covers, and what it does not) and the review date (when it will be looked at again, and what could bring that date forward). Here they are for an invented context.
Invented scenario:
Rosa Mendes manages Blue Door Travel, a nine-person agency in Lisbon. Staff use a chat tool for
itinerary drafts, customer emails and translations. Some of them paste customer passport
details into it to save time. Rosa has no written rule. She will write the agency's policy.Worksheet, filled in:
SCOPE Covers: all nine staff, any AI tool, for customer work and internal work.
Does not cover: customers' own use of AI; tools we do not use yet (a new tool
needs approval first, see "Ask first").
USERS Staff who draft or translate; Rosa, who approves new uses.
OWNER Rosa Mendes. Backup: Tomas Silva.
REVIEW 2027-04-12 (six months, because tools and rules change).
Earlier review if: an incident; a new tool; a change in a client or country rule
that Rosa learns about; staff report that a rule does not work.
WHAT WE We will list the rules we checked (with date and source) in a short log and
CHECKED mark each as confirmed, probable, ethical only or unknown.
UNKNOWN Whether our passport handling needs adviser review: ask before using AI on it.Notice that scope names what is left out, the review date has a reason, and unknowns are listed instead of hidden. Six months is a reasonable choice, not a rule: a faster-changing situation may need three, and a stable personal policy may use twelve. What matters is that a date and an owner exist.
Policy template
Copy this template, shorter than the twelve-heading form in Policies, Vendors, Records and Incidents: Responsible AI in a Small Team; its headings follow the acceptance checklist.
Template:
AI-USE POLICY: [name or organisation] Context: [student/teacher/freelancer/employee/owner]
Owner: [name] Version: [n] Date: [date] Review by: [date] Earlier if: [triggers]
1. SCOPE Covers [people, tools, tasks]. Does not cover [exclusions].
2. USES TABLE Use | who is affected | worst realistic error | risk (low/medium/high)
3. PERMITTED Low-risk uses I do without asking; I check every output.
4. RESTRICTED Uses where I ask first: [data], [people], [money], [grades], [health].
5. PROHIBITED Uses I do not do: [list].
6. DISCLOSURE When and how I say AI helped; who is the author; what I credit.
7. DATA, SOURCES What I never paste; licence and credit checks; what I verify and how.
8. ESCALATION High-stakes or unclear cases go to [person]; a human can be reached at [..].
9. CONCERNS How anyone raises a concern or appeals; reply within [time].
10. EXCEPTIONS Written request, named approver, end date, outcome noted.
11. TESTS Five scenarios tested on [date]; results; changes made.
12. UNKNOWNS Rules I could not confirm and who I will ask.One-page cheat sheet
Everything in this tutorial in a form you can print. Each line points to a page you have already read.
Cheat sheet:
DECISION PATTERN Situation > Who is affected > Benefits and harms > Options (incl. no AI)
> Evidence and unknowns > Decision and conditions > Accountable > Review date
PRINCIPLES Dignity | Fairness (not always identical treatment) | Avoid unnecessary harm
| Transparency in plain words | Accountability = a named owner | Privacy
| Accessibility. OECD and UNESCO texts are voluntary; they give shared words.
STAKES Ask: worst realistic error? who bears it? can it be undone? Care grows with it.
FAIRNESS Who is served worse? Results by group, with counts? Any proxy (address, name,
gap, language)? What do false positives and false negatives cost, and to whom?
Does one score hide a small group? Can everyone use the tool?
VERIFY Plausible is not verified. Tone is not evidence. Check numbers, names, dates,
quotes, citations at the source. A reviewer needs time, information, authority.
SYNTHETIC MEDIA A label is a claim, not proof; no label is not proof of fakery. Use several
signals; say "possible". For money or urgent requests: do not trust voice or
face; confirm through a channel YOU start; second approver; do not forward.
PRIVACY What data? Why? How long? Who sees it? Where does it go? Remove names first.
Pseudonymised is still personal. Anonymous can be re-identified. Children and
power imbalances weaken "agreeing". Public is not free to reuse.
COPYRIGHT Plagiarism = honesty; copyright = rights. Having a copy is not permission.
Check licences; "not stated" = unresolved. Attribution is not permission.
Record your own contribution. Do not promise exclusivity you cannot give.
DISCLOSURE Say AI helped when a rule requires it, a person would expect to know, or it
changes quality, risk or what they pay for. Say what you did and checked.
Read the actual rules first; if silent, ask in writing.
HIGH STAKES Job, health, money, housing, education, legal position, safety: a qualified
human decides; real oversight (info, time, skill, authority, records); notice,
reasons, appeal to an independent hearer; compare a non-AI option; if not
yet safe, do not use AI.
INCIDENTS Stop or contain. Keep evidence. Tell the named owner at once. Tell those
affected in plain words. Correct visibly. Short review: causes and fixes, no
blame. Change the policy. Concealing makes it worse.
FIND THE RULES Define case (place, sector, task, people, data) > list kinds of rule > go to
official home pages > check status, date, version > read the text or the
regulator's guidance > check scope > log it > ask an adviser if stakes are
high or the text is unclear. Label: confirmed / probable / ethical only /
unknown. Ethics, law and workplace policy are three different things.
ALWAYS Owner. Review date. A route to a human. "Do not use AI" is an option.Glossary
| Term | Meaning |
|---|---|
| Accountability | A named person or organisation who answers for an outcome and can fix it. |
| Accessibility | Whether people with different abilities, devices and languages can use a tool. |
| Anonymisation | Removing identifying details so a person cannot be recognised; harder to guarantee than it sounds. |
| Appeal | A route to have a decision looked at again by someone who can change it. |
| Attribution | Crediting the source or author. It is not the same as permission. |
| Automation bias | The habit of trusting a machine's output too much, even when you could check. |
| Bias | A systematic difference in how groups are served or treated. |
| Consent | A person's informed agreement to a stated use; it is weaker when there is a power imbalance. |
| Deepfake | Synthetic or altered audio, image or video showing a real person doing or saying something they did not. |
| Disclosure | Telling people that, and how, AI was used. |
| Dual use | A capability that can help or harm depending on who uses it. |
| Explainability | The extent to which a result can be explained; explanations can be limited or misleading. |
| Fairness | Treating people justly. It has several definitions that can conflict. |
| False positive / false negative | A wrong "yes" (flagged by mistake) and a wrong "no" (missed). Their costs differ. |
| Feedback loop | A result that shapes future data, so an early bias can grow. |
| Human oversight | A person who can review, change and stop a result, with the time and authority to do so. |
| Incident | An event where an AI use caused or nearly caused harm, or broke a rule. |
| Jurisdiction | An area with its own legal authority: a country, state or city. |
| Licence | The terms under which you may use a work. |
| Non-user | A person affected by an AI use who did not choose it. |
| Provenance | Information about where content came from and how it was changed. |
| Proportionate | Matching the care you take to the size of the risk. |
| Proxy | A detail that stands in for something else, such as an address standing for income. |
| Pseudonymisation | Replacing names with codes; the data can still be personal. |
| Re-identification | Recognising a person in data that was meant to be anonymous. |
| Retention | How long data is kept; deletion is removing it. |
| Stakeholder | Anyone affected by, or with an interest in, a use of AI. |
| Transparency | Giving people what they need to understand and respond, in plain words. |
| Voluntary framework | Guidance such as the OECD AI Principles or the NIST AI Risk Management Framework 1.0 (2023), not binding law. |
What's next
AI Ethics and Responsible Use: Advanced. It turns the habits of this tutorial into structured work: risk assessment and impact scoping for a bounded AI feature, fairness measurement with Python on toy data, system and data documentation, organisational governance and vendor review, and incident response with post-mortems. It uses only the Python standard library and synthetic data, and runs offline.
Level 1: choose a path. The platform's next level is organised as paths. Responsible-AI judgement helps in every one.
- AI Engineer. Building AI applications.
- ML and Data. Working with models and data.
- AI Infra and Ops. Running AI systems reliably.
- AI Quality, Security and Governance. Testing, protecting and overseeing AI systems.
- AI Business and Product. Choosing and shaping AI products and their use.
- AI Automation and Freelancing. Using AI to automate work and serve clients.
Keeping your judgement current
- Laws and standards change. A rule you checked last year may have a new date or version. Treat everything you logged as "as of" its date.
- Re-read your policy on its review date, and sooner after an incident, a new tool or a change of role.
- Follow official sources, not summaries: the legislation portal and regulators for your country and sector, and the publishers of the standards you rely on.
- Keep your scenario cards. Replay a few against the new version of your policy; a change that breaks an old case needs a reason.
- Stay open to disagreement. Ask a colleague or peer what you missed, and record what would change your mind.
Where this shows up at work
- A one-page policy with an owner and a review date is what a manager, client or school usually asks to see first.
- A decision file (policy, rules log, filled worksheets) lets you explain a choice quickly and shows how you think.
Common mistakes
- Writing a policy that fits every case. One rule for all uses treats all risks as equal. Fix: classify uses first and write different rules for low, medium and high.
- Skipping the scenario tests. A policy that was never tried has hidden gaps. Fix: run five cards and record the line that decided each.
- Omitting scope, owner or review date. Nobody answers for it and it ages. Fix: fill in these three before anything else.
- Treating the policy as law. It is your commitment. Fix: keep a rules log and ask an adviser when stakes are high.
- Using the cheat sheet instead of thinking. It reminds you of questions; it does not answer them. Fix: use it to start the worksheet.
Try it yourself
- Easy. Write the scope, owner and review date (with at least two triggers for an earlier review) for your own context, in the form of the worked example.
- Medium. Fill in milestones 1 to 4 for your context: six uses, the people affected, a risk level and a permitted, restricted or prohibited list.
- Hard. Complete milestones 5 to 10: write the rules, test five invented scenarios (one of them involving a synthetic voice message), revise, and explain it to a peer who plays a sceptic.
Answers
Easy. A strong answer: scope says who and what is covered and what is not; one named owner; a date in the future with a reason; at least two triggers (for example an incident or a new tool). Weak: "review when needed", no owner, or a scope that says "everything".
Medium. A strong answer: six or more uses, each with affected people (including non-users) and a worst realistic error; at least one use rated high and placed in the restricted or prohibited list; low-risk uses not treated as high-risk. Weak: every use rated "medium", or only the user listed as affected.
Hard. A strong answer: the policy has disclosure, data, copyright, escalation and appeal lines; the five scenarios get different answers, each linked to a policy line; the synthetic-voice case requires checking through an independent channel; at least one gap was found and fixed; the peer conversation lists what you could not answer and what would change your mind. Weak: all five cases pass with no changes, answers copied from the lab, or a defence that ignores the sceptic's concern.
Summary
- The capstone is a Personal and Workplace AI-Use Policy for one context, built in ten milestones and checked against ten acceptance items.
- Define scope, owner and review date first; give the review date a reason and triggers for an earlier look.
- The cheat sheet and glossary gather the decision pattern, checks and vocabulary of all 22 pages.
- Next come AI Ethics and Responsible Use: Advanced and the Level 1 paths.
- Keep your judgement current: laws and standards change, so re-read your policy on its review date and follow official sources.
Next: AI Ethics and Responsible Use: Advanced begins with Impact Assessment: Scope, Stakeholders and Harms for a Bounded AI Feature, the first page of the next tutorial.