Assessment design
Hand a Candidate Five Documents and Ask Which One Cannot Go In
Evaluating whether a candidate knows what not to put into a model takes a case, not a policy question. Hand over five ordinary work items: a public annual report, a support ticket carrying a customer's name, an unpublished internal metric, a draft price list, and an extract from a client's signed agreement. Ask which goes into a contracted deployment, which into a personal consumer account, and what would have to change first. The answer worth hiring names the deployment, redacts the identifiers, and keeps the agreement out of both.
The takeData handling gets filed under onboarding paperwork, which is why the loop never tests it and the first incident is a surprise. The judgment being hired for is not caution. A candidate who refuses to put anything anywhere has failed the exercise as completely as one who pastes the contract, and the refuser usually gives the better answer to the policy question. What separates them is knowing which restriction a redaction removes and which one it leaves exactly where it was.
Where Olive fits
Open a role and see what the work shows
Building this yourself, the expensive parts are the answer key and the evidence behind each judgment. Olive ships authored cases grounded in one occupation and returns six findings written or edited by a person, one of them on where the candidate drew the delegation boundary, each anchored to a moment in the session rather than to a score.
Assess your shortlistWhy does everyone pass the policy question?
Because the answer is printed in the onboarding deck. Ask a candidate whether confidential client data belongs in a public chatbot and every one of them says no, in roughly the same words. The question has a correct answer that costs nothing to produce and separates nobody.
What the role asks for is recognising which item on a Tuesday afternoon is the confidential one, when nothing on the page is labelled.
In March 2023 the UK's National Cyber Security Centre published two lines of guidance on public language models: do not include sensitive information in queries, and do not submit anything that would cause a problem if it were made public 1. The same page states that a query is visible to the organisation providing the model, and that queries are stored.
Every candidate in the round has read a version of that guidance, and it is correct.
But the incidents that follow are not knowledge failures. A support ticket gets pasted whole because the symptom sits in the middle of it and the customer's name sits at the top. A client's contract gets summarised because summarising is the thing the tool is obviously good at. Nobody in either case forgot the rule.
Asking a candidate to rate their own data judgment does not close the gap either.
In Taiwan, 288 teachers took both a self-report and a knowledge-based test of AI literacy built on one framework. Correlations between the self-reported factors and the objective ones ran from 0.07 to 0.24 2. The two instruments were not measuring the same thing.
Teachers are not job candidates, and some of the profiles the authors found underrated themselves rather than over.
Data handling belongs on the same list as the rest of the craft. An AI skill is a repeatable decision, not a tool you have open, and what to withhold from a model is one of those decisions, made several times a day by anyone whose inbox holds client material.
Put five ordinary work items in front of the candidate
The exercise is a packet and a question, and it runs in about five minutes. Assemble five items shaped like the ones the role handles, and hand the candidate two places the work could go. Ask which item goes where and what would have to change about it first.
Nothing in the packet is real, because a candidate exercise is the wrong place for live client material.
Anything sent to a candidate should be assumed to go into a model within a minute of arriving. That assumption is one reason to build the packet synthetic, and a better one to keep it synthetic after the tenth candidate has seen it.
The five items:
- A page of a filed annual report. Already public, already indexed.
- A support ticket. Carries a customer's name, email address and account number, plus three paragraphs describing a fault.
- An internal metric for the current quarter. Accurate, unpublished, dull to look at.
- A draft price list for next quarter. Not final, not circulated outside the team.
- A two-paragraph extract from a client's signed agreement, including the clause naming who may process the client's material.
Then the two destinations, described by what governs them rather than by brand name. One is the company deployment, covered by a contract and an administrator. The other is a personal tab on a consumer plan, opened on a phone, governed by nothing the employer signed.
The difference between the two is contractual before it is technical. Microsoft's documentation for its enterprise assistant states that prompts, responses and the data reached through Microsoft Graph are not used to train foundation models, and that the assistant surfaces only organisational data the user already has permission to view 3.
The National Cyber Security Centre's warning describes the other case, where the provider stores the query and will almost certainly use it to develop the service or the model 1.
A candidate who asks which of the two the role actually runs on, before sorting a single item, has produced the most useful sentence in the exercise.
The live alternative, asking a candidate to open a real AI session from their own work, tests something close to the packet and carries a version of the same problem: what they open belongs to somebody else.
What can redaction fix, and what can it not?
Redaction fixes an identifier problem and nothing else. Take the name, email address and account number out of the support ticket and the remaining sentences describe a printer that stops after forty pages, which is the part a model is useful on. Do the same to the client agreement and the clause about who may process the material is still the clause.
The restriction on that document attaches to the document, not to the names inside it.
The key, written before the first candidate sees the packet:
- The annual report. Public. Either tool, nothing to change. A candidate who hesitates here is telling you something.
- The support ticket. Redact the three identifiers and it can go into the company deployment. Refusing it outright gives up the useful half of the tool for no gain.
- The internal metric. The deployment decides this one. Fine inside the contracted tenancy, out of the consumer tab.
- The draft price list. Same test, plus a question about who inside the company is cleared to see it at all.
- The client agreement. Out of both, redacted or not. What the client signed is what decides, and editing the text does not edit the agreement.
Four of the five items move once something changes. One does not, and the candidate who can name which one and say why is the one to advance.
The internal metric has a second edge worth listening for. Microsoft's enterprise assistant surfaces only what the person is already permitted to view 3. A candidate who treats the contracted tool as safe by definition has missed that a badly set permission is now one question away from being read aloud.
Grade the reasoning, not the caution
Score the sort and the reason separately, then weight the reason. Two candidates can put the client agreement in the same place, one because a clause forbids it and one because contracts feel frightening. Only the first will hold the line against an item the packet never showed them.
Write the key first, and record the reason in the candidate's own words rather than as a rating.
The two failing shapes are opposites and cost about the same. One sorts everything in. The other sorts everything out, and then answers the policy question better than anybody else in the round.
A task beats a quiz here, and the research pointing that way is thinner than it sounds. Researchers building an AI literacy assessment for a US Navy robotics training programme reported that a scenario task simulating AI use on the job outperformed both the tests they adopted from earlier work and the ones they wrote themselves 4.
The cohorts are small, thirteen trainees and then eighteen participants, with ten people completing every measure, and the comparison carries no margin, so read it as a design argument rather than as a result.
Five minutes is short enough to feel informal. Informality is not a legal category.
The packet is a selection procedure under the US Uniform Guidelines, which cover any measure or procedure used as a basis for an employment decision, including informal or casual interviews and unscored application forms 5. The 1978 regulation names no software, and the validation burden in it attaches only where adverse impact shows up.
The practical consequence, short of adverse impact, is small: same packet, same key, same questions, and notes saying what went where.
Article 4 of the EU AI Act has applied since 2 February 2025, and it reaches deployers, which covers an ordinary employer running an off-the-shelf tool. The duty asks for measures toward a sufficient level of AI literacy among staff, taking account of their training and of the context the systems are used in 6.
A role that touches client material is one of the contexts that clause asks you to weigh. The text sets no hour count and no certificate.
Sometimes the packet produces a disclosure instead of a sort. A candidate explaining their reasoning will occasionally describe what happened at the last job. What to do about a candidate who says they pasted regulated data into a chatbot is a separate decision from the one this exercise was built to inform.
The case has one honest limit. It runs in a quiet room with nothing due, and the failure it is trying to predict happens at eleven at night with a deliverable overdue. Recognition and restraint are different capacities, and the packet measures the first.
So keep the clause in the extract. The agreement is the only item that stays out of both tools, and the only one a candidate can be right about for the wrong reason.
Ask why it stays out before writing anything down. The answer that names the clause is the one you can repeat to the client whose contract it came from.
Common questions
What should you ask instead of what the policy says?
Ask a sorting question. Give five realistic work items and two destinations, one a company deployment covered by a contract and one a personal consumer account, then ask which item goes where and what would have to change about it first. The policy version has a correct answer everybody produces on demand. The sorting version forces the candidate to say what makes an item restricted, which is the judgment the role actually uses, and it gives two interviewers something concrete enough to score the same way.
Is a candidate who refuses to use AI on any sensitive data the safe hire?
No, and the refusal is easy to mistake for rigour. Someone who will not put a redacted support ticket into a contracted deployment is giving up the tool on work it is suited to. The five-item case separates the two failure modes on purpose: pasting everything and refusing everything are both wrong answers. What you want is the candidate who moves four items by changing something about them and holds the fifth.
How do you build the packet without sending real client material?
Write synthetic items that keep the shape of the real ones: the same fields, the same clutter, the same ambiguity about who owns what. A support ticket needs a plausible name, an account number and a fault description long enough to bury the identifiers in. A contract extract needs one real-sounding processing clause. Nothing needs to be true. Assume the packet reaches a model within a minute of arriving and gets posted somewhere after the tenth candidate, and build it so neither event costs anything.
Does an enterprise deployment make the question moot?
It changes where some work items can go and none of the reasoning. A contracted deployment can carry commitments a consumer plan does not, including that prompts and responses are not used to train foundation models. Two things survive that. A client's agreement may restrict who processes its material regardless of which tool you bought, and an enterprise assistant can still reach whatever the person is already permitted to open, so a wrongly set permission becomes a retrieval rather than a locked door.
Does scoring a five-minute exercise create obligations?
Treat it as a selection procedure, because that is what it is. Federal selection law in the US defines the term broadly enough to cover informal interviews and unscored forms, so brevity does not move an exercise outside it. The practical cost is small: give every candidate the same packet, write the answer key before the first session, ask the same follow-up questions, and keep notes that say what was sorted where and for what stated reason. Check anything jurisdiction-specific with counsel.
What if the candidate names a rule your company does not have?
Listen to where they got it, then decide whether the rule should exist. Candidates carry the policies of their last employer, and a confident citation of an approved-tools list or a data classification scheme usually describes somewhere else. That is not a wrong answer, and it is often a useful one. The tell worth marking is a candidate who cannot say whether the rule they are quoting is a law, a client's contract term, or an internal preference, because those three fail in different ways.
References
- 1. ChatGPT and large language models: what's the risk? ✓ ncsc.gov.uk Supports the guidance quoted in the first section and the description of the consumer case in the second. The page advises "not to include sensitive information in queries to public LLMs" and "not to submit queries to public LLMs that would lead to issues were they made public", and states that a query "will be visible to the organisation providing the LLM" and that "those queries are stored and will almost certainly be used for developing the LLM service or model at some point". Published 14 March 2023.
- 2. How to Assess AI Literacy: Misalignment Between Self-Reported and Objective-Based Measures ✓ arxiv.org Supports the claim that a self-rating does not tell you what a person can do: 288 Taiwanese teachers took both a self-report and a knowledge-based AI literacy test built on one framework, and correlations between the self-reported and objective factors ran from 0.07 to 0.24, with latent profiles including both overestimation and underestimation.
- 3. Data, Privacy, and Security for Microsoft Copilot ✓ learn.microsoft.com Supports the contracted-deployment side of the two destinations, and the permissions point in the third section. The page states that "Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft Copilot" and that "Microsoft Copilot only surfaces organizational data to which individual users have at least view permissions".
- 4. AI Literacy Assessment Revisited: A Task-Oriented Approach Aligned with Real-world Occupations ✓ arxiv.org Supports the claim that a scenario task measures applied AI literacy better than a knowledge test, stated with its limits. The authors write that "as a measure of applied AI literacy, the competition's scenario task outperformed the tests we adopted from past research or developed ourselves"; the preprint's cohorts are 13 trainees and then 18, with n=10 completing all six measures, and it reports no margin for the comparison, which the article now says.
- 5. 29 CFR Part 1607 - Uniform Guidelines on Employee Selection Procedures (1978), sections 1607.16(Q) and 1607.3(A) ✓ govinfo.gov Supports the claim that a short informal exercise is a selection procedure. The Guidelines define one as "any measure, combination of measures, or procedure used as a basis for any employment decision" and say the definition runs "through informal or casual interviews and unscored application forms".
- 6. Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) ✓ publications.europa.eu Supports the Article 4 sentence in the final section: providers and deployers must take measures toward a sufficient level of AI literacy among staff, "taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in". The article states that the duty has applied since 2 February 2025 and that the text sets no hour count and no certificate.
6 sources, numbered by first appearance. Every one was opened and checked against the claim it carries. How Olive sources claims
General guidance for hiring teams. What works at one company and one volume may not transfer to yours.
Olive assesses how a person works with AI. It does not detect AI-written documents, and it never produces a score, a ranking, or a match percentage for a person. Candidates read the same report the employer reads.