Use this when there is no acceptable use policy, or when the current one predates AI tools, remote work or personal devices. You get three documents in a new folder, ./acceptable-use-policy-drafting/: the staff policy itself, two to three pages in plain language (acceptable-use-policy.md); a note of the choices leadership made and how people really work today, for the people who own the policy rather than staff (decisions.md); and five quiz questions to check that a colleague understood it after one read (comprehension-check.md). This skill drafts for a human to review and sign; this skill never marks a control effective. HR and leadership approve the policy, and HR or legal confirm anything touching employment terms or monitoring.

Inputs to gather

Read before asking: the current policy or employee handbook section, device management reports, the single sign-on app list, a finance summary of software and AI subscriptions (ask for tool names and counts, not raw card records naming people), the incident log (lost devices, phishing, data sent to the wrong place) and the data classification scheme if one exists. Then ask the reader, in one message: who uses personal phones or laptops for work today, which AI tools are approved or paid for, whether staff work from abroad, and whether the company monitors devices or traffic.

Step 1: find how people really work

Look for the gaps between the rules people are told and the tools they use: subscriptions to AI assistants paid on personal cards, personal phones used for sign-in approval, file sharing apps outside the managed list, a team that works from cafes. Write each one as a fact in the decision note (decisions.md), without naming individuals. A ban on something half the staff do daily turns into a policy nobody follows; give an approved route instead.

Step 2: put the choices to the reader as decisions

List each choice with two or three options and a recommendation, and get the reader's answer before drafting:

Devices: company devices only, personal phones allowed for email and sign-in under device management, or personal devices allowed with browser-only access.
AI tools: which tools are approved, under which account type (company-managed accounts whose terms exclude training on inputs, versus personal free accounts), and which data classes may go in. A workable default: public and internal data in approved tools only; no customer data, personal data, credentials or source code unless the tool and use are approved for that class; a human checks output before it reaches a customer or production.
Remote work and travel: where work is allowed, rules for public networks and shared spaces, and whether travel to some countries needs approval or a clean device.
Personal use: what reasonable personal use of company devices and accounts looks like.
Monitoring: what is monitored and why. Staff must be able to read this in the policy itself; in several countries monitoring also needs consultation with staff representatives, so route this decision to HR or legal.