如何建立 AI 文化，同時保障資料安全

As the operations manager who built Muse Group‘s AI governance framework – the acceptable use policy, the risk guardrails, the maturity tracking – here is what I recommend to start with, based on what we’ve done at Muse Group.

Seventy-four percent of both millennials and Gen Z say they’re using AI in some form in their day-to-day work, according to Deloitte’s most recent Gen Z and Millennial Survey. Many of them feel they’re adapting to the new tools faster than their organizations are – and they’re making their own rules about how to use AI along the way.

Before you build governance for AI in your company, or start embedding it into how people actually work, you need to know what you’re actually trying to avoid.

The Lethal Trifecta

AI tools are valuable because they’re fluent, fast, and confident. Those same three qualities make them risky. Fluent, authoritative-sounding output isn’t the same thing as accurate or ethical output. The real exposure starts when employees use personal accounts, share sensitive information, or trust an answer without checking it.

There’s also a meaningful difference between AI as a chatbot and AI as an agent. A chatbot, at worst, gives you a bad answer. An agent can act on it – executing a plan, editing files, sending a message, without a person in the loop. The researcher and Django co-creator Simon Willison, who has written extensively on AI agent security, named the highest-risk version of this the “lethal trifecta“: it occurs when a single agent has, at the same time,

• access to private company or client data,
• exposure to untrusted content from the open web or third parties (which opens the door to prompt injection – malicious instructions hidden in that content), and
• the ability to act externally, such as sending messages, moving data, or changing files.

When all three combine, an agent can be manipulated into leaking data or taking harmful action, sometimes without anyone realizing it happened until well after the fact.

In my experience, the most common failure isn’t malicious – it’s complacency. People trust fluent output without checking it, or don’t realize a personal AI account isn’t the same thing as a sanctioned company tool. That’s also why I’d argue having no AI strategy at all can be just as damaging as having a bad one. The goal of everything below is simple: make sure those three conditions never line up in the same place.

The Non-Negotiables

Build the policy with legal and data protection from day one – and assume people are already ahead of you.

Most of your employees are already using AI, whether you’ve noticed it yet or not. And if your company doesn’t have a policy in place, you’re probably not deciding whether to build one anymore, you’re just late. The only real choice left is how fast you close that gap.

Start with legal and your data protection officer, not as a rubber stamp at the end but from day one: any request for a new, non-approved tool routes through their review before anyone starts using it, not after. But don’t stop at writing the policy – give your DPO, your legal team, or whoever is leading AI adoption an actual platform to explain why those rules exist. A policy nobody understands the reasoning behind gets quietly ignored. A policy people understand gets actually followed.

We also built a practical checklist so people can vet a new tool themselves – checking things like whether it’s a known provider, whether it has a real privacy policy, whether it looks legitimate – without waiting on formal approval just to start experimenting. The goal was to make sure governance doesn’t slow adoption down. But the one rule that doesn’t bend, checklist or not: sensitive company or customer data only goes into a tool after it’s actually been approved.

If parts of your company were already using AI before any policy existed – and they almost certainly were – don’t pretend that didn’t happen. Build a review process specifically for that shadow usage: bring it into the light, assess it against the same standard as everything else, and either approve it, adjust it, or wind it down.

The policy needs a clear line on what can and can’t be shared with AI – what’s safe to share freely, what needs a team lead’s sign-off first, and what’s strictly off-limits regardless of how convenient it would be. That line has to be specific enough that someone can actually check their own situation against it, not just a vague “use good judgment.”

And when a question doesn’t fit neatly into that line, there should be a specific, named person to ask. In our case, that’s the DPO and the operations managers who built the governance framework: real people, not a generic inbox.

Maintain a living, vetted list of approved tools.

Give teams a framework to choose their own tools, then get them approved – not a fixed list handed down from the top. The framework should say what the company already provides, what it recommends, how to request something new, and how to get a candidate tool checked for compliance. Operations and legal assess policy fit and contract terms; IT checks what “secure” actually means technically – single sign-on support, data residency, integration risk, what happens if a vendor gets acquired or shuts down. The review itself needs real teeth: what does the vendor do with your data, do they train on it, who are their subprocessors, can you get your data deleted if you leave.

At Muse Group, we run a lightweight trial process for exactly this – a team can test a tool outside the existing list, with a quick compliance check built into that flow, so curiosity doesn’t automatically mean risk.

Turning Policy Into Practice

Use role-based access.

Not everyone needs the same level of AI access – this is the access-to-private-data leg of the trifecta showing up directly in how you structure permissions. A team handling customer data or financial records needs a tighter approval path than a team using AI to draft internal copy. Be explicit about which use cases require sign-off and which are open by default – ambiguity here is exactly what pushes people toward personal accounts.

From generic foundations to real-world use

Generic training has its place – it gives everyone the same basic footing on what AI can and can’t do, and the ground rules for using it responsibly. But once people move past that and start actually experimenting on their own, the questions get specific fast: a finance person wants to know how this applies to finance work, a support person wants a support example, not an abstract one.

That’s why we lean on demos over decks. On our companywide check-ins, teams show real examples of how they’re using AI to speed up their own work or get better results – not a hypothetical, but something a colleague actually built last week. It does more for adoption than any policy document, because it shows people exactly what’s possible in their own function, from someone doing the same job they are.

We’ve also learned it’s not enough to talk about how powerful AI is; you have to address what people are actually worried about. We keep documentation on common hallucination patterns and known bias issues, and we’ve built a network of AI-fluent people across the company as an informal expert group – right now that mostly means a Slack channel where people can ask questions and get a real answer, though we’d like to grow it into more direct one-on-one pairing over time.

Keep the conversation open – genuinely

Depending on your size and priorities, you need one or a few people clearly responsible for AI culture, and part of that job is making sure AI stays in the conversation, not only  something people only hear about through a policy document.

At Muse Group, that runs through three channels.

• There’s a company-wide Slack channel where anyone can ask a question about AI and get an answer
• On our companywide check-ins, teams demo real examples of what they’re building or automating with AI
• And every month, we publish an internal AI Pulse digest covering AI news broadly – what’s happening in the industry, what’s changing in the tools people use, and what’s actually happening inside Muse Group itself. We’re deliberate about keeping it unbiased: it covers the concerns and failures in AI just as much as the breakthroughs.

Make AI Culture Visible

AI culture shouldn’t just get a policy and a Slack channel – it deserves its own dedicated plan, with real budget and ownership behind it, the same way you’d launch any other internal initiative you actually wanted to land. Newsletters, workshops, Q&A sessions with outside experts all give you a chance to show what responsible AI use actually looks like, not just describe it. We’ve hosted sessions with people like Corey Brown, author of The Prompt Expert, and Oleg Smirnov, composer and Assistant Chair at Berklee College of Music, talking about what AI means for the future of music specifically, rather than AI in the abstract.

This isn’t about hype, though. Educate people, and balance the breakthroughs with the practical – how to use their access responsibly, what information is off-limits, when a decision should stay entirely human. AI can accelerate the work. Employees remain responsible for checking outputs, protecting sensitive information, and knowing when something shouldn’t be automated at all.

None of this works unless all three conditions of the lethal trifecta are addressed. In the framework we’ve built at Muse Group, each one is covered by something specific. Role-based access is what limits private data: it decides who can put sensitive information anywhere near an agent in the first place. Policy and vendor vetting are what limit the ability to act: they cap how much an agent can do unsupervised once it’s already touching something sensitive. The hardest condition to cover is exposure to untrusted content itself – a hallucinated answer, a manipulated document, a webpage with hidden instructions – which is why we educate employees on hallucination and bias patterns, and why we emphasize that a human stays in the loop for everything, not as an occasional check but as the standard. If you get these three things right, teams can use AI more confidently without giving it more autonomy than they should.