Bolt-on
Do the work the same way you always have. Ask AI to check it or clean it up at the end. AI is a spell-checker for your thinking.
Lessons 1-3 — talking points, terminology links, and facilitator notes for the live session.
Most people use AI like a smarter Stack Overflow — reactive, task-level, query-driven. AI-first asks a different question up front: if AI is in the loop from the beginning, how does the shape of this work change?
This isn't about trust — it's about leverage. You're not trusting AI to be right. You're using it to compress time to a reviewable draft, then applying judgment where it matters. What doesn't change: critical thinking, accountability, domain expertise.
"AI" covers everything from a spam filter to an autonomous agent executing code on your infrastructure. If you can't distinguish between them, you can't assess risk or write policy.
| Term | One-line definition |
|---|---|
| LLM | Generates text based on patterns in training data — no built-in memory, bounded context window, fixed knowledge cutoff |
| SLM | Smaller, runs locally/on-device — more privacy-friendly for sensitive workloads |
| Prompt | The structured input you give a model — quality of input determines quality of output |
| Context window | The max amount of text a model can process at once |
| Hallucination | Confident but factually incorrect output |
| Agent | An LLM with tools and autonomy to take multi-step actions, not just generate text |
| Agentic system | Multiple agents/tools coordinated on a complex task — expanded attack surface |
Public vs. private models is about access and data handling, not capability. If work data goes into a tool, verify in writing the provider isn't training on it — "they probably don't" is not a security control.
Most AI outputs are bad because most AI inputs are vague. CLEAR is a checklist that forces you to give the model what it needs.
| Letter | Question to ask yourself |
|---|---|
| C — Context | Does AI know my situation well enough to give specific advice? |
| L — Length & Format | Have I told AI exactly what format and length I want back? |
| E — Examples | Have I shown AI what good looks like? |
| A — Audience | Does AI know who this is for and what they care about? |
| R — Role | Have I given AI a specific expert identity to work from? |
Run the same task twice, live: "Write a phishing email for security training" (no CLEAR) vs. the full CLEAR version from the lesson. Let the room see the gap themselves — don't just describe it.
"Vibe coding" — coined by Andrej Karpathy in Feb 2025 — means fully giving in to the vibes and forgetting the code exists: accept every suggestion, don't read the output. Fun for a throwaway project. Not what this bootcamp teaches.
You're right that hallucination is real. A senior analyst's first draft also has errors — you review it. AI output at its worst is like a confident but occasionally wrong junior analyst. You don't fire the junior analyst; you build a review step.
Unstructured prompts get unstructured results. CLEAR gives you a repeatable structure that changes the quality of what you get back. Same task, different prompt, different output — try it before you decide.
Roles that are entirely execution — boilerplate, standard reports, repetitive formatting — will change. Roles requiring judgment, context, and accountability become more valuable, because the people in them can now do more. The risk isn't AI — it's not engaging.