What do you want to use?

Keep daily work and AI work apart. Use a separate admin login for changes that need extra power.

1. Before changing accounts, make a backup. On a work Mac, ask your IT owner to help.
2. Open System Settings → Users & Groups → Add User. Create an Administrator account for maintenance, if you do not already have a suitable one. Give it a unique password and test that you can sign in.
3. From that admin account, add two Standard users: Personal and AI Work. Keep your existing personal files in their current account. If converting that account to Standard, first test the separate admin account; then turn off ‘Allow user to administer this computer’ for the daily account.
4. Use Personal for daily life and AI Work for AI tasks. Log out or use Switch User to move between them. Use the admin account only for approved maintenance. Do not remove your only working admin account.
5. In AI Work, sign in only to needed services. Review shared folders, browser profiles, app access and iCloud sync before adding files.

These users share one Mac and operating system. Standard users can change their own settings; this setup does not block every app or upload.

A second computer keeps the AI work on different hardware.

1. Use separate devices when the work calls for a stronger split than Mac logins can give.
2. Set up the AI device with only the accounts and files it needs. Avoid copying your full personal browser or cloud setup.
3. Choose one approved way to move files. Check what syncs, who can share, and how each device is backed up.

A security key helps you sign in. It is not a second work computer. Shared accounts and folders can still connect separate devices.

A cloud identity is the account you use to sign into an online service.

1. Create a dedicated email/account, or use the work identity approved by your organization. An email alias in the same mailbox does not give you a separate mailbox.
2. Use that sign-in for AI services and the browser in your AI Work user. Check the account name before connecting any app.
3. Keep personal mail and personal sign-ins in the Personal user. Write down who owns each AI account and how to recover it.
4. If personal Gmail is the recovery address for an AI account, record that link. Protect and maintain that mailbox; do not assume the accounts are fully separate.

A different email does not change a provider’s data rules or stop access to files shared with that account.

A shared folder can be a planned bridge between your personal and AI accounts.

1. Make a folder for approved material. In Google Drive, choose Share, add the exact AI-work account, and use Viewer if it only needs to read.
2. Keep General access set to Restricted. Check the people with access and any access inherited from a parent folder or shared drive.
3. Test from the AI-work account. Put only reviewed files in the folder and remove access when it is no longer needed.
4. Check the connector’s requested access too. Sharing one folder does not mean an app’s permission is limited to that folder.

Summaries and removed names can still reveal private facts. Review what you share; do not assume an abstraction is anonymous.

A vault is a group of saved passwords. Its access rules matter more than its name.

1. Use unique passwords in a trusted password manager. Create Personal and AI Work vaults if your plan supports them.
2. Check who can open, edit, share or export each vault. In the AI Work session, make only needed credentials available where your manager supports that limit.
3. If the same unlocked account can open both vaults, they are organized but not fully separated. Use separate memberships or accounts when you need a stronger split.
4. Give tools a limited service credential when supported. Never paste your main vault password, recovery codes or broad API keys into a chat.

An API key is a password-like code used by software. Keep it in approved secret storage, not in a prompt or shared file.

MFA asks for more than a password. Security keys and passkeys can help protect against fake sign-in pages.

1. In each service’s security settings, turn on MFA and register a supported key or passkey. Follow that provider’s steps.
2. Test sign-in. Add a backup method where supported, and store recovery codes separately from the everyday device.
3. Keep recovery email and phone details current. Record who can recover the account, including any workplace administrator.
4. Do not remove your only working recovery method. Review the plan when a device, phone number or team member changes.

These tools protect sign-in. You still need to check what a connected app can do after sign-in.

Choose what the provider may store or use before adding your work.

1. Confirm you are in the intended personal or organization account. For work, use the account type and settings your organization approves.
2. In ChatGPT, open Settings → Data Controls. Review ‘Improve the model for everyone’ and turn it off if you do not want conversations used for model training. Check the equivalent controls with other providers.
3. Review chat history, memory, retention and deletion separately. Turning off training does not make processing local or erase existing chats.
4. Check connected services’ own data policies too. An AI service’s privacy setting does not replace the rules of an app receiving your data.

Available controls depend on the provider, plan and workspace. Use approved data only, even when training is turned off.

Connectors, apps and plugins let AI tools reach other services and data.

1. Review the plugin’s publisher, included tools and requested connections. Connect only what you need and trust; check the account, requested data and allowed actions before approving.
2. Choose the smallest access available. Start with read-only access when enough, and require review before sends, edits or deletes where supported.
3. Test with a harmless file and inspect the result. Approval settings control when the AI asks; they do not narrow the access granted to the connected app. Do not assume a request for one folder limits a broad permission.
4. Review access often. Remove unused connections in the AI app and check the source service’s third-party access settings too.

Disconnecting stops future access according to the service’s controls; it may not erase copies already processed. Review retention and deletion settings.

Small habits reduce mistakes across all four pathways.

1. Keep macOS, browsers and apps updated. Review screen lock, disk encryption and backups with the device owner.
2. Use only the files needed for the task. Review AI output before using it or sending it to someone.
3. For work or client data, confirm approved providers, account types, access, data categories, retention rules and required agreements with your organization.
4. Record the account owner, approved uses and review date. Review access after role changes, remove unused access, follow retention and deletion rules, and keep a clear way to report a mistake.

This guide helps you prepare. Your organization decides what is approved; a checklist alone does not prove compliance.