Use ai-usage-policy

Draft an organisation's AI use policy or staff guidance from what it has told you about its people, tools, data and worries

Draft an organisation's AI use policy or staff guidance from what it has told you about its people, tools, data and worries — every "don't" paired with what to do instead (or who decides, when no approved way exists yet), what to do if data has already gone into a tool, and no claim about a tool, licence, owner, regulation or commitment the input didn't give. Written in the length, labels and voice the audience needs.

Reach for it when a team needs rules for what people may put into AI tools, or asks for an AI acceptable-use or governance policy. Do NOT use to write a repo's agent-tooling policy (that's agents-md-generator) or to analyse one agent's capability surface (that's agent-threat-model).

Install it

npx skilldrop-cli install ai-usage-policy                 # Claude Code, your user folder
npx skilldrop-cli install ai-usage-policy --project       # Claude Code, this repo
npx skilldrop-cli install ai-usage-policy --ide cursor    # or kiro, codex, antigravity, copilot

It is part of the AI engineering pack: --pack ai-engineering installs it with its neighbours.

Ask for it

Say it the way you would to a colleague. Requests like these route to it:

• "Write our AI acceptable-use policy"
• "What are people allowed to put into these AI tools?"
• "We need AI governance rules before we roll this out"
• "Draft data-handling tiers for AI tool usage"

Requests like these belong to a different skill, so it shouldn't answer them:

• "Generate the AGENTS.md for this repository"
• "Threat model our agent's data access and exfiltration paths"
• "Plan the rollout cohorts and enablement"

If another skill answers instead, ask for this one by name: "use ai-usage-policy".

Check what you get

A good result:

• Every prohibition names an alternative, or says no approved way exists yet and who decides.
• There is a line on what to do if it has already happened.
• Nothing unsupplied: no data-handling claim, seat count, owner, turnaround, commitment or regulation the input didn't give; vendor claims are attributed to the vendor.
• The tool list is checked against the input and mismatches are named.
• The length, voice and labels fit the audience asked for.
• No notes, tags or questions to the requester inside the policy.

Use something else when

• Writing a repository's agent-tooling policy (AGENTS.md — build commands, conventions, what agents may edit) — that's agents-md-generator.
• Threat-modelling one agent's data reach and exfiltration paths — that's agent-threat-model.
• Planning how the tool reaches people — that's ai-adoption-rollout.
• Assessing whether governance is mature enough yet — that's ai-readiness-assessment.
• A security review of a design — that's threat-model.

Next

• SKILL.md, the instructions the agent reads
• Its page on the site
• Related: agent-threat-model, agents-md-generator, ai-adoption-rollout, ai-readiness-assessment, threat-model

Edit this page on GitHub · View source