Page 158 - CyberSecurityEssentialsEnglish

What to notice: The framework is a continuous cycle: define the task and the risks, set the
limits of delegation, review the output and its evidence, then document what was used and

what changed.
Source: The 4D framework is prepared by the author, drawing on principles of AI risk

management. It is not an official framework issued by any standards body [1][2].

4.1 Why Is a Good Prompt Not Enough?
◆ Key idea: quality does not equal safety.
A prompt can be clear and the output linguistically excellent, and yet the task may be
unsuited to the tool, the data too sensitive, the sources wrong, the result biased, or the
execution irreversible. Prompting improves communication; safety requires a decision, a
review, and limits.

In Chapter Two we learned that clarity of purpose, context, and format raises the quality of
an output. But the quality of the wording does not by itself answer questions such as: may
this data be entered? Who is affected if the result is wrong? Does the system use current

sources? Does it have permission to send a message or modify a record? And can the user
detect the error before it turns into a decision?
Risk is not only the probability of an error. It is the probability of error combined with the

size of its effect. An imprecise answer about a general idea may be low impact, because the
reader can correct it easily. A small error rate in a hiring, treatment, or student assessment

decision may be very high impact. There is therefore no single checklist for all tasks.

Uncertainty is the space in which we do not know how correct the output is, how complete
the data is, or how valid the assumptions are. Confident language does not remove
uncertainty. Generative models may produce a well-formed sentence even when the

information is incomplete, which is why fluency of expression must be separated from
strength of evidence.

Risk-adjusted productivity means calculating the time a tool saves after subtracting review
time, the cost of errors, rework, and the probability of harm. A tool may be faster at

producing a draft yet slower in real use if it requires extensive correction or creates conflicts
between versions.
Published risk-management frameworks for artificial intelligence offer a view that ties risk

to context, measures it, and manages it, with characteristics such as validity, reliability,
safety, security, transparency, privacy, and fairness [1][2]. In this chapter we translate those
principles into a simple cycle that an individual or a team can apply to an everyday task.

157