Volunteers at a community spinning loft paste donor spreadsheets into a public chatbot because no one said we couldn’t. What should the loft require first?

Volunteers at the community spinning loft pasting donor spreadsheets into a public chatbot because nobody said they couldn’t shows governance must start with a written acceptable-use policy. The loft should require a clear statement of allowed data classes, allowed tools, and forbidden uses—such as pasting donor personally identifiable information into consumer chat—before relying on habit or hallway folklore. Written policy enables training, enforcement, and incident accountability when someone violates the rule.

Folklore only fails by concept: an unwritten habit is not a policy and cannot be audited, taught consistently, or cited in an incident review. Amazon Quick fails because a charting product is not an acceptable-use policy and does not state forbidden pastes. From-scratch pre-training fails because rebuilding a model from a crawl does not create organizational rules about donor data and public tools.

Exam caveat: policy without training and technical barriers still fails—pair the document with tool allowlists, approved loft accounts, and data-loss prevention where feasible. Operational check: publish the acceptable-use policy, brief spinning-loft volunteers, block or warn on paste of spreadsheet-like donor PII into unapproved chat tools, and record acknowledgment before donor work continues.