Housing authority caseworkers increasingly use generative tools on tenant communications. What should the AI security program maintain?

Establishing AI-specific acceptable-use guidelines that clarify permitted tools, prohibited data types, and approval procedures is the action that creates consistent, enforceable boundaries. Housing caseworkers increasingly use AI on tenant data; without written guidelines, some will use approved tools carefully, others will paste sensitive data into public chatbots, and the authority will have no basis for consistent enforcement. Guidelines must state: (1) approved tools (internal tool A, vendor tool B with NDA, not public ChatGPT), (2) prohibited data (tenant names, family details, financial info), (3) approval procedure (ask supervisor for new tools), and (4) consequences (using unapproved tools triggers retraining or disciplinary action). Written, accessible guidelines signal the authority's expectations and enable audits.

Maintaining only a centralized registry of vetted generative models with approved data-handling addenda inventories tools but does not create enforceable boundaries; caseworkers cannot derive permitted uses, prohibited tenant data, or escalation paths from a registry listing, and they will make inconsistent choices about what may be entered where. Requiring a documented human-review workflow with supervisor approval of generative drafts before tenant correspondence release checks outputs but does not prevent risky inputs; caseworkers can still paste tenant names, family details, and financial info into unapproved public models, and review alone does not define which tools may process tenant data. Providing role-based handling instructions requiring manual redaction of tenant identifiers before generative tool input is error-prone and incomplete; busy caseworkers will miss identifiers under time pressure, and redaction alone does not establish permitted tools, full prohibited-data categories, or escalation paths for new casework uses. Browser-based tools, especially public AI, are often less controlled than desktop applications and should be treated more strictly.

Operational check: within 30 days, publish a one-page AI acceptable-use policy for housing caseworkers covering: (1) approved tools (list them), (2) prohibited data (tenant names, health, financials), (3) approval process for new tools, and (4) consequences. Include a QR code linking to tool-specific FAQs. Conduct awareness sampling of 15 caseworkers after 60 days; if fewer than 70% know the approved-tools list, conduct targeted re-training.