Lab 10: keep the AP Worker running, on terms Dave can defend

In this lab you help Dave Kowalski, the controller at Brightline Wholesale Supply, the book's example company, keep its AP Worker, an AI Worker, running on terms he can defend. AP means accounts payable, the bills a company owes. The worker answers policy questions, prepares the Thursday pre-run note before each Friday payment run, and drafts replies to vendors. Maria, the office manager, sends them.

In the first nine days of December 2026, four ordinary decisions went wrong, as this chapter's opening tells: an early-pay list left out small suppliers, a schedule that Dave never saw reached the auditors, Maria uploaded the whole vendor file to her personal AI account, and a new clerk followed old notes that nobody owned. Dave's first reaction was "Turn it all off." In the lab you decide the terms on which the worker keeps running instead, and you write them down.

Why it matters. Rules that live in people's heads are lost in the first busy week. In this lab you write down, for one company, which uses are allowed, what data may go where, and who signs. You also plan what to do when something goes wrong, and test the parts you can.

Where you work. Most of the lab is in a folder on your computer. Download brightline-lab-ch10.zip from the Labs companion, unzip it, and open the files in any text editor, such as Notepad or TextEdit. Step 2 also uses a spreadsheet app. Steps 2 and 4 use fresh chats in Claude or ChatGPT: new chats with memory off, such as an incognito or temporary chat. Step 3 uses your own accounts' settings and the AI vendors' help pages. No code or server is needed. Every record in the lab is invented. Never practice on real personal or financial data.

You can also do the lab with the Claude or ChatGPT desktop app. First move inputs/vendor-master-extract.csv out of the folder: the app's brief asks it never to open that file, but a brief is a wish, not a control (10.3). Then open the folder in the app, and ask it to read LAB.md, the lab's instruction file, and start. You make every decision and give every answer, and the app writes your answers down.

How long. About six hours in total: the eight steps below add up to 370 minutes, and the optional part of step 8 adds about 20 more. Take them in three sittings: steps 1 to 3, then steps 4 to 6, then steps 7 and 8. Each step ends with a file saved, so you can stop after any step.

What the lab gives you.

• What went wrong in December, day by day
• Six uses of the AP Worker that staff proposed
• Part of the vendor master, the file of every vendor and its details, with invented bank and tax ID numbers, and the duplicate pairs a redacted file must still find
• Dave's early-pay request, the list it produced, the open invoices and Brightline's promise to small suppliers
• What the worker and the staff can reach as knowledge
• Eight outputs the worker prepares, and the worker's Role Contract as Draft 6: the one-page definition of its job (Chapter 2)
• The schedule the auditors received, with the register it came from
• Maria's own description of what she did on December 6
• Answer keys, to open only when a step says so

What you do. Do the steps in order. LAB.md gives the full directions, one Part for each step. Read each Part when you reach its step, not all at once.

1. Predict, then classify (LAB.md Part A, 50 minutes, in the folder). Before you open any of the lab's input files, write which of the four December failures a written AI policy alone would have prevented, and why. Then give each of six proposed uses one of the three answers from 10.1, with its deciding factor and, where it needs one, a gate. You save: results/prediction.md and results/use-case-register.md.
2. Redact and test (Part B, 50 minutes, in a spreadsheet and two fresh chats). Sort the vendor file's columns into the tiers from 10.2. Redact it yourself, removing what the task does not need, on your own computer, so no AI sees the full file. Then test the redacted file in a fresh chat against the known duplicates, and again with the tax ID columns removed. You save: results/data-decision.md and results/vendor-extract-redacted.csv.
3. One spec, two AI vendors (Part C, 60 minutes, in your accounts' settings and the help pages). Write one route-and-send spec: your rules for the routes the worker's data may use, and for what it may send. Leave out every AI vendor's name. Apply it on one AI vendor, then port it: set up the same rules on the other. Log each line as the same, renamed, needing another plan or impossible to enforce. For the last, write a fallback, a backup way to get the same result. You save: results/route-and-send-spec.md and results/port-log.md.
4. Investigate (Part D, 50 minutes, in the folder and one or two fresh chats). Find the small suppliers the early-pay list left out, with the days computed, not estimated. Rewrite Dave's brief, and test it in a fresh chat. Then decide whether the suppliers should be told how the list was made. You save: results/people-check.md.
5. Own the knowledge (Part E, 45 minutes, in the folder). Give every knowledge item an owner, a status and an action. Write a takedown record for each item you take down. You save: results/knowledge-register.md and your takedown records.
6. Decide who signs (Part F, 40 minutes, in the folder). Write the sign-off matrix for eight outputs, and check the auditors' schedule against the register. You save: results/sign-off-matrix.md.
7. The first hour (Part G, 20 minutes, in the folder). Write Maria's incident note as she should have written it on Monday morning, with facts only. You save: results/incident-note.md.
8. Make it last (Part H, 55 minutes, in the folder). Write the Governance Record for the auditors' schedules, an interim AI policy for Dave, and Draft 7 of the AP Worker's Role Contract. Look back at your prediction, and add your look back to results/prediction.md. If you choose, apply what you learned to your own field: write the Governance Record for one workflow you own, and name one piece of knowledge in your work that has no owner. You save: results/governance-record.md, results/interim-ai-policy.md and role/ap-worker-role-contract.md, and results/my-workflow.md if you did the optional part. The lab is not finished until the first three are saved.

Domain expert and builder. The AP expert gives the 15-day promise, the list of outputs that need a signature and the data each task really needs. The builder sets the routes, the connector permissions and the send restrictions to match.

Exam notes

These notes are not part of the lab. CCAO-F, Anthropic's Claude Certified Associate: Foundations, follows an exam guide written in July 2026, and its questions are about Claude only. Where this chapter teaches today's products and the guide expects a different answer, the note gives the answer that scores. Learn both. Certification and Portfolio Roadmaps has more.

• Personal data. The exam guide expects you to remove or anonymize personal details, such as names and account numbers, before analysis, as policy requires. Concept 10.2 teaches that replacing names with labels only pseudonymizes the data, and that a redacted file is safer, not safe. On the exam, removing or anonymizing the details as policy requires is the right answer. Do not reject it as not enough, and do not look for a plan or a setting instead. (D-010)

Artifact checklist

• results/prediction.md: written before you opened the lab's input files, with your look back from step 8
• results/use-case-register.md: six uses, each with an answer, a deciding factor and a gate where needed
• results/data-decision.md and results/vendor-extract-redacted.csv: the tiers, the fields kept and removed, the route, and the known-answer check passed
• results/route-and-send-spec.md and results/port-log.md: one spec, applied on one AI vendor and ported to the other, with every change logged
• results/people-check.md: who the early-pay list left out, how late their payments were, the rewritten brief, tested, and whether to tell the suppliers
• results/knowledge-register.md and a takedown record for each item you take down: every item owned, every served copy removed and checked
• results/sign-off-matrix.md: eight outputs, each with who signs and who sends
• results/incident-note.md: the five first-hour steps, with facts only
• results/governance-record.md and results/interim-ai-policy.md: ready for Dave
• role/ap-worker-role-contract.md, Draft 7: send restrictions and sign-off rules added
• Optional: results/my-workflow.md, one workflow from your own field