Five rules for using AI safely in IT support

I use AI assistants every day to explain errors, draft client updates and write PowerShell. They're genuinely useful. These five habits keep that usefulness from turning into a problem.

1. Never paste secrets or client data

Passwords, API keys, recovery codes, licence keys and customer personal data stay out of the prompt. Redact names and domains, or swap in placeholders like user@client.co.uk. Check what your company's AI policy allows, and which tools it has approved.

2. Test every command in a lab first

AI-written scripts can look perfect and still be wrong: an old cmdlet, a missing filter, a delete that hits more than you meant. Run it in a lab or against a single test object before it goes anywhere near a client tenant.

3. Ask it to explain, not just to answer

"Why does this fix work?" teaches you more than "fix this". It also exposes weak answers quickly. If the explanation doesn't hold together, the fix probably doesn't either.

4. Check against official docs

Portals like Microsoft 365, Intune and Entra change their menus constantly. If an AI gives you a click path, confirm it against current Microsoft Learn pages or the vendor's docs, especially for anything security-related.

5. You own the change

The AI doesn't get the phone call at 8am when logins stop working. Read every line, understand what it does, note it in the ticket, and have a way to undo it. Destructive changes still need the same approval they always did.