Your Organisation

Decision-Grade for Leaders

Data judgement for dashboards, spreadsheets, reports and AI outputs • 2.5 hours

About me

Greg Baker

Data Science lecturer, Macquarie University · Consulting CTO

• Works across data science, software engineering, AI governance and executive education.
• Lectures in data science at Macquarie University and has worked as a consulting CTO and adviser across government, enterprise and technology organisations.
• Focuses on reliable decisions from imperfect data, dashboards, spreadsheets and AI outputs.
• Clients include ACT Treasury, the Administrative Appeals Tribunal, Allianz, AstraZeneca, Atlassian, Aon, Auckland City Council, the Australian Parliament, Fujitsu, Hewlett-Packard, Vodafone and Woolworths.

Why Data Governance Matters More With AI

• AI multiplies what you already have — the good and the bad.
• Models can’t see unwritten context — owner, source, as-at date, caveats, audience. If it’s only in your head, it never reaches the prompt.
• Inconsistent definitions become inconsistent answers. When “active asset” or “open case” means three different things, an AI assistant may choose one definition, blend them, or answer fluently without exposing the mismatch.
• Access decisions become retrieval decisions. The assistant inherits whatever stale folders, old projects, and broad permissions the user can still see.
• Ungoverned spreadsheets get treated as truth. Stale tabs, manual overrides, and “final_v3” files get pasted into prompts.
• Unlogged transformations can’t be reviewed. A model can summarise your number, but it can’t reconstruct the steps that got you there.
• Quality thresholds matter more. AI lowers the cost of producing an answer; it doesn’t lower the cost of acting on a wrong one.
• Speed. Errors caught at human speed have already been forwarded across the organisation at AI speed.

What we’ll be covering 1/2

• Sponsor practical data governance: reinforce need-to-know access, documented purpose, least privilege, review/expiry, and auditability — including the AI exhaust we now generate and folder guides that keep the source of truth easy to find.
• Ask better vendor/tool questions: require disclosure of AI use, data handling, logging, retraining, change control, monitoring, and review arrangements before approval.
• Start with the decision, not the dashboard: define the decision, uncertainty, action threshold, time horizon, and evidence needed before asking for reports — because data abundance now makes starting from the data a trap.

What we’ll be covering 2/2

• Reduce reporting risk: move away from versioned spreadsheets, screenshots, and copied extracts — the sprawl AI now amplifies — toward repeatable, source-connected reporting with clear ownership and traceability.
• Challenge dashboards for trust cues: ask for source freshness as well as dashboard refresh, clear metric definitions, denominators, owners, caveats, and enough lineage to explain the result.
• Apply responsible AI oversight: treat sharing with an AI tool as a sharing act, keep data and prompts in approved environments, and ask the core assurance question: “Has this been through the AI assurance process?”
• TL;DR: what to ask, what not to accept, and what minimum standards to reinforce so teams can use data and AI with less hidden risk.

Last updated: 2026

Risks and governance

Who Owns What? Owner, Custodian, Steward, Author, Approver

You Are the Custodians

Three roles leaders play in data protection:

• Sponsor — you approve which tools, platforms, and vendors access your team’s data.
• Gatekeeper — you set the tone for what gets shared, with whom, and through which channels.
• Escalation point — when classification is unclear, your team looks to you.

Custody is not a job for the data team alone — it starts with the decisions you make and the shortcuts you tolerate.

Common Leakage Paths

• Forwarded screenshots.
• Copied extracts.
• Broad sharing by attachment.
• Uncontrolled local working files.
• Context lost when artefacts move between channels.

Mosaic risk

• Aggregating lots of minor data points into a complete whole used to be so tedious that no-one would do it.
• When humans did the aggregating, the snippets of secure data that reached the shared document repository didn't pose a security problem.
• And if you deliberately aggregated snippets, you knew you were breaking the rules.
• With AI doing the aggregation, you can accidentally assemble a classified picture in the shared document repository.
  • The usual protocols apply for misclassified data.

Vendor and Tool Questions

• Default for vendors and contractors: no AI use in delivery until explicitly approved.
• Questions to ask:
  • Has this been through the AI assurance process?
  • What data goes in, and what comes out?
  • Can data be retained or used for retraining?
  • What logging or traceability exists?
  • How are updates approved? When is the next review due?
• Embedded AI features still count as AI use.

Multiple choice? Does this contain AI or not? (Government wide the AI assurance process)

We were protected by slowness

The failure modes didn’t change — AI just removed the lag that used to let us catch them.

AI speed exposes data-system gaps

• At human speed, weak systems create inconvenience.
  • Stale definitions, missing owners and unclear sources cost time and cause occasional mistakes.
• At AI speed, weak systems create errors faster.
  • The same gaps produce fluent, plausible answers and pass them on as fact.
• AI removes the friction that used to slow things down.
  • Finding, summarising, drafting and spreading all outrun human review.
• So the data system has to be visible.
  • Source, owner, freshness, definition, handling, review and exception rules must be explicit and accessible.

Last updated: 2026

How to request data well

Bridge · What AI actually changes

Effort no longer decides the artefact.

Dashboards used to be the hardest artefact to produce, report writing the easiest. AI compresses all four to roughly the same effort.

The trap isn’t that AI lowers quality — it’s that we now reach for the most ambitious artefact by default. The question to ask is what form best fits the decision, not which one looks most impressive or easiest to generate.

Bridge · Decision-Ready Briefs

What to request

• Dashboards monitor. A standing view of a changing state for an operational user.
• Briefs decide. A written recommendation you can act on.
• Spreadsheets reconcile. A bounded list because you need to sort, filter, or compare.
• Extracts transfer. A narrow slice of data with source, freshness, caveats, and handling still attached.

Four Steps of a Decision-to-Data Brief

Vague request → DATA CART

From Vague Request to DATA CART

A decision-ready request travels with the checks needed to answer it safely.

Spell it out and AI has a chance to answer the question you actually meant.

Bridge · Decision-Ready Briefs

Before and after the rewrite

Request Rewrite

Rewrite a vague request into a decision-ready brief — structured, not a brainstorm.

• Pick a real request you’ve given in the last month.
• Write the brief against the DATA CART fields.
• Mark what’s missing — which fields needed a follow-up question?
• Decide the artefact — dashboard, extract, written answer, or no data at all?
• No real one? Use the synthetic the priority service area / the core operational system worked example.

Optional: the DATA CART helper at https://decision-grade.industrial-linguistics.com/data-cart — synthetic examples only; an external, unsigned demo site, so no real personal, sensitive, or client data.

Last updated: 2026

How to forward data well

Travelling vs Non-Travelling Artefacts

• Travelling artefacts. Forwarded reports, spreadsheets, extracts, status notes, recurring emails, report packs.
  • Leave the creator’s control. Get forwarded, copied, pasted into briefing packs, treated as reusable evidence.
  • Need enough context to survive being separated from the person who made them.
• Non-travelling artefacts (products). Power BI dashboards, published apps, internal tools.
  • Stay in place. People return to them. Have access settings, refresh schedules, a semantic model behind them.
  • Outlive the original request. Can mislead for weeks if stale, ownerless, or poorly defined.

Stuff that gets forwarded

If it travels, give it CHORDS.

• Caveat — the known limit a reader should be told.
• Handling note — classification and who it can be shared with.
• Owner — the team or person responsible for it.
• Refresh / As-of — when the numbers were last refreshed.
• Definition — what each key metric actually measures.
• Source — where the numbers come from.

Data quality and validation was your cohort’s most-raised issue — these are the cues that catch it.

If CHORDS Isn't in Place, AI Makes These Kinds of Mistakes

• Caveat missing — the model states a number with confidence the data doesn’t support.
• Handling missing — sensitive material gets quoted in an output that travels further than it should.
• Owner missing — nobody to ask when the answer looks wrong, so the wrong answer ships.
• Refresh missing — stale figures are presented as the current state of the network.
• Definition missing — two metrics that sound alike get mixed, and the recommendation tilts the wrong way.
• Source missing — the model fills the gap with a plausible-sounding but fabricated reference.

Minimum Safe Sharing Rules

TRAVEL is the quick check before information leaves your hands. Keep the data inside approved environments — no personal drives, personal accounts, or unmanaged tools.

• T — Tag / label the exact your organisation handling marking on the artefact itself.
• R — Reason the decision or question this will serve, in one line.
• A — Audience named recipients or a scoped group, not "the team".
• V — Venue / channel an approved environment appropriate to the marking; share the link, not the file.
• E — Evidence / as-at named source system and the date the data represents, on the artefact.
• L — Limit / expiry when the recipient deletes, refreshes, or re-confirms access.

Run TRAVEL before it leaves your hands — and share the link, not the file.

TRAVEL + AI

When the Recipient Is an AI Tool

Pasting into a chat, uploading to a tool, or pointing an agent at a folder is a sharing act. TRAVEL still applies — but four letters change shape.

• A — Audience: the model is a recipient. Assume the vendor, the training pipeline (if any), and anyone who later prompts it (if there is memory) are part of the audience.
• V — Venue: use only your organisation-approved AI tools and tenancies. Public Copilot, ChatGPT.com, free Gemini are not approved venues for work content.
• E — Evidence: AI outputs aren’t sources. Treat them as drafts; trace any number, name, or quote back to the system it came from before it leaves your hands.
• L — Limit: the model has no expiry. With memory, what you paste in today can resurface in another chat, team, or tenancy. Don’t paste what you wouldn’t email.

AI access is still access.

AI Doesn’t Change Recordkeeping

The records legislation still applies. AI tools just add three places where records hide.

• Prompts and pasted content are records. Anything you type that documents a decision, advice, or transaction is a State record (the records legislation) the moment you send it — same as an email.
• Mostly a matter for IT to handle — but don’t have personal chats on work AI!
• Disposal cuts the other way. A model with retrieval over a the document store site sees what’s there today. Records that should have been disposed of get resurfaced — retention failures become live again.

If it’s a record on paper, it’s a record in the prompt.

Last updated: 2026

Spreadsheets

AI bots love spreadsheets

• Usually named something that is clear and promising.
  • Searching the document store finds it quickly.
• Bots can read them directly. Approved assistants may have spreadsheet tools; bots that can run code usually have libraries that treat sheets like databases.
• They don’t take up much of the context window compared to other document formats.
  • Tool-use outputs vs injecting a document.
  • The headers on each tab get read (usually).
  • The values get read more readily than the logic, formatting, or judgement behind them.

Where Spreadsheets Fit — and Where They Become a Risk

When spreadsheets are fine

• Ad-hoc exploration, one-off analysis, personal working files.
• Small, low-stakes, short-lived datasets.

When they turn into shadow systems of record

• Same file is reused for recurring reports or decisions.
• Logic, overrides, or adjustments live only in the sheet.
• Different people add rows, columns, exceptions, or meanings over time.

Warning signs

• Multiple versions in circulation; manual merges between files.
• Hidden logic in cells or macros; uncontrolled extracts from source systems.
• The spreadsheet is the only place the business rule exists.

Why Spreadsheet Sprawl Happens

• Weak source access.
• Urgent reporting demand.
• Manual handoffs.
• No shared evidence standard.
• Local heroics become the operating model.

Spreadsheets

Spreadsheet Risk Spectrum

Risk rises with reuse, audience, and dependence on the file for decisions.

• Low risk — working file: one person, single use, throwaway. E.g. scratchpad for a call.
• Medium risk — shared working file: small team, reused weekly, still internal. E.g. team tracker with a few manual joins.
• High risk — quasi-report: emailed to leaders, hidden formulas, owner unclear. Decisions are starting to lean on it.
• Unsafe — shadow system: recurring decision use, multiple versions, no owner, no audit. The org runs on it; nobody governs it.

Signals that shift a file right: reuse, hidden logic, growing audience, recurring decision use.

Why does AI magnify that?

• Low risk — working file: won’t even be found by a the document store search. Unless you deliberately load it as input, it won’t get used.
• Medium risk — shared working file: if last week’s version is in the conversation history, it will still be roughly right (usually).
• High risk — quasi-report: lots of copies in important places — “that version from last year must be very important.”
• Unsafe — shadow system: “I apologise, I shouldn’t have deleted that file. You were right to call me out on that.”

Spreadsheets

Same Program, Different Cost Boundary

Two spreadsheets, same the major capital program program, different answers.

Both can be technically defensible — they answer different questions, and neither file labels its scope boundary on the front page.

A spreadsheet can be technically accurate and still be decision-dangerous when the scope boundary, owner, or inclusion rules are unclear. If humans don’t realise the difference, how will an AI know?

Spreadsheets don’t always love AI back

AI is good at reading spreadsheets when the spreadsheet is already behaving like data — much less reliable when it behaves like a picture, a notebook, a dashboard, or an application.

Not all spreadsheets are equal — for humans or AI

Spreadsheet Danger Level

Score a spreadsheet you already use, then decide what context would make it safer.

• Score it — run the spreadsheet risk scoring artefact at https://decision-grade.industrial-linguistics.com against the sheet you had open earlier. What’s the score?
• Sense-check it — if it’s high, is that because the sheet is also hard for humans to understand?
• Add context — what could you write alongside the file to make it safer for humans and AI? For example:
  • “Rows 2–140 are raw incidents; rows 141–150 are summary totals — exclude them from incident counts.”
  • “Red cells mean manually escalated, not necessarily overdue.”
  • “The pivot is filtered to May only and was refreshed yesterday.”
  • “Treat Acme, ACME Pty Ltd, Acme Corp as the same supplier unless checking exact records.”
  • “Sensitive — do not paste personal details into a public AI tool.”

Last updated: 2026

Dashboards

For dashboards, use CHORDS and dashboard clocks

• A Power BI dashboard is a maintained product. It needs a named owner, version, refresh policy, metric definitions, known limits, support path, review point, and retirement trigger.
• Two clocks — three with AI.
  • Forwarded spreadsheet: one clock — the as-at date.
  • Power BI dashboard: two — when the tile refreshed, and when the upstream source actually changed.
  • With AI layered on top: a third — when the tool last retrieved or indexed the context.

Decision-Ready Dashboard Checklist

• Show both refresh dates — dashboard and source.
• Show source and owner.
• Define the metric and the denominator.
• State caveats and exclusions.
• Show enough lineage to explain how the result was produced.

Data quality and validation was your cohort’s most-raised issue — this checklist is what catches it.

If a dashboard cannot answer these, treat it as background — not as a basis for action.

Dashboard Detective

Open the Power BI training dashboard (synthetic data). Spend ten minutes finding what a publisher should have caught.

• Spot it — missing source-refresh cues; unclear or missing definitions; a percentage with no denominator; copied-extract or local-file lineage; an audience or handling marker that doesn’t match the environment.
• Note it — for each issue, write one line: what you saw, why it matters, and what you would change before it could be published.
• Debrief — share the worst issue you found and the one most likely to fool a busy reader. We line them up against the Dashboard-as-a-Data-Product fields.

Power BI synthetic training dashboard — link in the chat.

AI Exhaust

AI Exhaust = the data debris of AI use

• Every AI interaction leaves a trail — “AI exhaust” / “AI debris”:
  • Prompts.
  • Retrieved context.
  • Audit logs.
  • File references.
  • Chat transcripts.

What AI Exhaust Can Reveal

• What is being asked of AI.
  • Prompt topics, attached files, retrieved sources, frequency, repeat queries — a live read of what work people are actually doing.
• Where the answers come from.
  • Which spreadsheets, drives, documents, and inboxes the AI is reaching into — the de facto source-of-truth map for the agency.

Rich Signal, Dangerous Inference

• Wrong proxy.
  • Prompt volume is not productivity. Reading more is not the same as doing more.
• Chilling effect.
  • If staff believe prompts are being watched, behaviour changes.
• General privacy problems.

AI Exhaust Game

Pick one of the three packs. Your job: infer what operational activity may be happening.

• Which individual records looked harmless?
• Which combinations changed the risk?

The data abundance problem

Information Explosions in the Past

The pattern: when knowledge becomes too large to hold using previous methods, something has to change.

• Stephanos of Byzantium → the Ethnika.
  • Alphabetical ordering makes encyclopaedic material searchable.
• Printing press → indexes and bibliographies.
  • More books require better tools for finding what is inside them.
• Linnaeus → taxonomy.
  • Classification makes large collections of living things usable.
• Dewey, catalogues, librarianship.
  • Hierarchies of knowledge: what you’ll find where.
• The web → search engines.
  • Ranking and retrieval become the interface to too much information.

AI means having a lot more data than we used to

• Documents get created even for the trivial.
  • Meeting notes, automated transcripts and summaries — capturing the everyday because the cost of doing so is near zero.
• AI exhaust: higher volume, granularity and interpretability.
  • Logs and audit trails have always existed; AI creates new exhaust — prompts, retrievals, tool traces — at much higher volume, granularity and interpretability.
• Too low value in the past.
  • AI-generated commentary, induction material and auto-generated primers — content not worth producing manually.
• Meta-analysis that is new.
  • AI sweeps over databases and file shares pulling out language patterns, vocabulary and mentions of people and places.

Implications of Data Explosion

More data creates three layered problems — and the answers get structurally harder at every step.

Severity escalates →

Solutions get structurally harder

Induction

• Pick a folder or report. Explain its contents as if your partner is an enthusiastic but naïve intern.
• What did you find yourself explaining? Is there a document already in existence that says what you said?
  • If there is, where is it? Would the intern have found it themselves?
  • If not, how would this intern learn about this folder or report?
• Ask: can your team find this context next time, and will an approved assistant find the same thing?

Maps

• The new explosion. Drafts, transcripts, summaries and AI outputs multiply faster than humans can read them.
• What’s new this time. The volume is machine-generated, so the solution has to be all of:
  • Machine-readable and human-readable.
  • Machine-writeable and human-writeable.
  • Search-engine friendly.
• What’s needed. Indexes that say where to look for documents, what to trust, purposes, definitions, and more.

What’s happening with Agentic AI and software development

• In software projects, tools such as Codex and Claude Code can use root-level guidance files like AGENTS.md or CLAUDE.md to understand structure, conventions and safe ways of working.
• Organisations need the same pattern for knowledge

Folder Guides for Everyday Workspaces

• Everyday workspaces need a Folder Guide. For the document store, Teams, OneDrive, shared drives, dashboards and spreadsheet estates, the equivalent is a Folder Guide, Knowledge Map, Start Here file, or Source-of-Truth note.
• Approved AI can help draft it. Ask it to inspect the folder, propose the map, then have the accountable owner correct what is authoritative.

Typical filenames — usually found in the folder itself

• 00_START_HERE — Folder Guide.docx
• 00_INDEX.md or 00_SOURCE_OF_TRUTH.md
• README.md
• AGENTS.md or CLAUDE.md — e.g. if you use Codex or Claude Cowork

A Plan for Mapping Spreadsheet Sprawl (and document sprawl in general)

• 1. Cluster by purpose. Group near-duplicates and abandoned drafts using filename patterns and modification age.
• 2. Inventory the shape, not the contents. Filenames, owners, locations, last-modified, size, sensitivity labels.
• 3. Identify what matters. The handful of files that are doing work become governed datasets with owners, as-at dates, and review points.
• 4. Make an initial folder roadmap (index). It doesn’t have to be complete, or perfect.
• 5. Let the roadmap be updated. If people disagree about sources of truth, it’s better to have that documented.
• 6. Find your upstream users. People who depend on your outputs should be encouraged to document that in the roadmap.

What you will often put in a folder guide

Build the Folder Navigator

Use the folder from the last exercise — or the synthetic FarWest site folder navigator from the website.

• Create a folder guide that helps a new staff member and an AI assistant avoid guessing.
• It doesn’t have to be perfect or complete — “Not sure, might be…” is fine.
• Include known upstream users — with a note asking anyone who uses the folder to add themselves to the list.

The good news

• Much of this index creation can be done by AI. A sample prompt is on the data-literacy website.
• Run a long trawl occasionally — e.g. once a month, let it sweep for relevant documents.
• It speeds up AI for other tasks.
• It speeds up human tasks too. Finding the source of truth is a common problem at Your Organisation.

What leaders should now ask

Before evidence travels into a decision

• What decision will this support?
• What definition, denominator and threshold are being used?
• How fresh is the source, not just the dashboard?
• Who owns the artefact?
• What caveat or handling rule must travel with it?
• Has any AI use been through the approved assurance process?

Where to look: approved tools list  •  AI hub / guidance  •  handling and classification guidance  •  who to ask when unsure