secure-ai

A training programme for teams that handle sensitive data and must use AI safely.

Your team has an AI assistant that reads documents, an agent with access to email, a search tool over the shared drive. It works well in the demo. Then someone pastes a client contract into a public chatbot, an agent follows an instruction hidden in a web page, a model's answer includes a name it should never have seen, and the auditor asks who approved all of it. You write a rule for that case. The next case breaks a different rule. Policies pile up and nobody remembers them.

This programme replaces that loop with one set of rules, agreed once.

What it covers

• Sets one rule per kind of data, not per tool. The same rule appears in the policy, in the training and in the access settings, so what people are told and what the system allows never disagree.
• Keeps the useful work going. Nothing stops for the team that follows the rules. Low-risk uses are cleared quickly; only what touches sensitive data gets extra review, approval or logging.
• Falls back to a process that already exists (your current approval and incident routes), never to a third parallel one.
• Separates the people lever (training, habits, who approves) from the system lever (access, logging, limits), so a careful team on a weak setup and a careless team on a strong one each get the right fix.
• Starts from your data. Instead of a generic checklist, the programme sorts what your team actually handles (client records, contracts, source code, personal data) into classes, and gives each class its own rules on where it may go and who may see it.
• Tests with exercises. Participants attack their own setup in a safe environment: planting a hidden instruction, asking for data they should not get, tracing who approved an action. A rule is only kept if the team can show it working.

The method

The tier is chosen from the most sensitive data your team touches, then rounded to a format your calendar can carry. One decision, in one place.

Enrol

Executives

/plugin marketplace add arclight/responsive-motion

/plugin install responsive-motion@responsive-motion

Two separate sessions. Then a follow-up, or simply describe the concern and we will place it. /responsive-motion

Other formats

Any team that handles SKILL.md regulated data (health, finance, legal…), with Book a call:

npx skills add arclight/responsive-motion

Or in-house:

git clone https://github.com/arclight/responsive-motion
ln -s "$PWD/responsive-motion/skills/responsive-motion" ~/.claude/skills/responsive-motion

Agenda

Once enrolled, bring a real situation:

"The photo in the pinned services section is crushed on 1366×768"
"The method column is sticky but taller than the screen on my iPad"
"The blue block overlaps the hero photo by a few pixels on some laptops"
"The navbar turns blue at the top of the page on small screens"
"We keep adding iPad-landscape media queries and the next device breaks"

Each of these becomes a case in the session. We assess the risk first, name the policies and people involved, then agree actions and test them.

Or take it one module at a time:

/responsive-motion diagnose              # measurements + file list, writes nothing
/responsive-motion implement <section>   # one named section per call
/responsive-motion verify                # one measured round across six formats

How a day goes

1. Map. The team lists every AI tool in use, what each can read and do, who owns it and where its data goes, including tools nobody approved. Nothing is proposed before this map exists, and it is rechecked at the end.100dvh − 26rem
2. Agree. It names the teams and systems it will touch, one at a time, and waits for sign-off. It never redesigns how a team works to fix a single leak.
3. Apply in order. Data classes and owners first (no visible change), then access limits, then approvals, then logging and monitoring, then incident drills, then the audit trail.scene:flat:
4. Review in bounded rounds. One full round across teams, fix everything it shows, one confirmation round, stop.

What is included

skills/responsive-motion/
  SKILL.md                    trigger phrases, task patterns, procedure, non-negotiables
  reference/principles.md     the seven rules, the five levels, expected result per device
  reference/recipes.md        thirteen recipes with code: single criterion, matchMedia helpers,
                              static CSS in two parts, visibility vs display, subgrid alignment,
                              photo in a fixed column, reserved space, real-box calibration,
                              trigger priority, navbar colour sources, navbar links, fluid values
  reference/verify.md         formats, tooling (chrome-devtools MCP, claude-in-chrome, by hand),
                              copy-paste measurement snippets, emulation pitfalls
  reference/anti-patterns.md  what not to do, with the failure that taught each rule
  reference/large-screens.md  1920 px and beyond: frozen validated width, one horizontal axis,
                              fluid type and spacing tokens, bounded visuals, cascade-layer pitfalls
.claude-plugin/               plugin manifest and single-plugin marketplace

Tools

Examples use common situations: a shared chat assistant, an agent with email access, a document search tool. Every module starts from a principle first; the product names are replaceable. The exercises need only a browser.

Basis

Written for teams where one careless prompt or one over-permissive agent becomes a real incident. The case library keeps the failures behind each rule.

Get involved

Feedback is welcome, especially: scenarios from other sectors, questions your auditors ask, and results from your own teams that contradict what the programme teaches. Write to contact@arclight.im.

Contact

© Arclight