ORIGINAL SYNTHETIC SCENARIO: no real company, account or private records inspected.

Business: Alder Services, a fictional Canadian maintenance firm.
Accountable owner: Operations Lead. Reviewers: Privacy Lead and IT Lead (fictional roles, not named actual people).
Proposed tools: an organization-managed business AI workspace, exact product/plan and configuration NOT YET SELECTED. Staff also have personal AI accounts that are not approved for internal records.
Requirement: assess any customer-record use before upload; minimize data; keep external replies draft-only. Any location or retention requirement must be confirmed by the Privacy Lead rather than assumed from a Canadian billing address.

G01 Public FAQ rewrite: input is approved public service text with no personal details. Proposed policy route PERMITTED after an approved workspace is selected and its allowed-data rules are confirmed. Human reviews facts before publication; no automatic publishing.
G02 Support-theme summary: proposed input is redacted customer feedback. Route RESTRICTED PENDING REVIEW. Privacy Lead must confirm sufficient redaction, purpose, contract and full data path; IT Lead must confirm account, access, connections and retention controls. No upload approved yet.
G03 Payroll comparison in personal chat: input would contain raw payroll and employee identifiers. Route PROHIBITED UNDER THIS PROPOSED POLICY. Do not upload; any redesigned use requires a separate assessment in an approved environment.

Known gaps: product/plan, regional processing/storage coverage, retention/deletion evidence, connector inventory, actual access settings and incident contact route remain UNKNOWN or UNSET. No actual vendor approval, legal compliance finding, synthetic control test or deletion verification has occurred.