Safe Setup: Where AI Runs and Where Your Files Live

Here’s what I did. My AI work happens on a standalone all-in-one PC that is:

• Not joined to the county domain. A domain is the central system your IT staff uses to manage county computers: logins, passwords, updates, and security settings.
• Not signed in to the county tenant. A tenant is your county’s own space in Microsoft 365: county email, OneDrive, Teams, and SharePoint.
• Not on the county LAN. A LAN (local area network) is the network inside your building that connects county PCs, servers, and printers.

Instead, it connects by Wi-Fi to the public side of the office’s internet modem. It can reach the internet, so the Claude and ChatGPT desktop apps work normally. But it has no inside path to anything county: no file shares, no voter registration system, no county email.

Why this helps: if something goes wrong on that PC (a bad instruction, a harmful web page, a command I shouldn’t have approved), the problem stops at that PC. There’s nothing county on it, and nothing county it can reach.

What the diagram shows:

• County network (left, or top on a phone): domain-joined PCs, servers and file shares, the voter registration system, and county email and Microsoft 365. It reaches the internet through the county firewall, which your IT staff manages.
• AI workstation (right, or bottom on a phone): a standalone PC that isn’t joined to the domain and isn’t signed in to county accounts. It connects by Wi-Fi to the public side of the internet modem, outside the county firewall.
• Between them: no connection. Both use the same internet service. The workstation can reach the internet the way a home computer can, but it has no inside path to county systems.

What “the public side of the modem” means

Your office’s internet comes in through a modem (or gateway) from your internet service provider (ISP). In most offices, the county’s firewall sits right behind it, and everything county sits behind the firewall. The “public side” is a connection that comes off the modem before the county firewall, such as a separate Wi-Fi network or a separate port. A device there is outside the county network, a lot like a visitor’s laptop at a coffee shop.

The exact setup depends on your ISP and how your office’s network is built. Some offices don’t have a public side at all, because their internet comes through the county’s own network. In that case, the only way to do this may be a separate internet line, which is a decision for your IT staff and your supervisor.

Keep the bridge closed. The workstation stays separate only if you keep it that way:

• Don’t sign in to county email, OneDrive, Teams, or the county VPN (the secure remote connection into the county network) on this PC.
• A USB drive carried between a county PC and the workstation is a bridge too. Carry only green (public) files, and follow your office’s removable media policy. If you keep your projects on an external drive, keep that drive with the workstation.
• Keep Windows, the web browser, and the AI apps updated. Keep Microsoft Defender (the antivirus built into Windows) turned on.
• Don’t save county passwords in this PC’s browser.
• Sign in to AI tools with the account your office approved. Work done for the office can be a public record, whatever computer it’s on (see AI conversations can be public records).

If you can’t set up a separate workstation

That’s common, especially in small offices. The simpler option works for most green work: ask IT to approve the Claude or ChatGPT desktop app on your normal work PC, and use it for green (public) information only. Then:

• Give it one project folder at a time, and keep nothing in that folder but public files.
• Keep connectors and plugins off.
• Use Manual permission mode (see below) and read every approval. On a county PC, the app runs commands as you, so it could reach anything your Windows account can, including network drives.

If your county’s Microsoft 365 includes Microsoft Copilot Chat (formerly Microsoft 365 Copilot Chat), that’s another option your IT staff may already manage.

A government-grade option to ask about. Anthropic offers a separate version called Claude for Government. It runs in a FedRAMP High authorized environment (FedRAMP is the federal security approval program for cloud services) and is a desktop app that includes Claude Code (Anthropic lists its command-line version and Claude for Microsoft 365 as early access). Anthropic’s own pages differ on which governments can buy it, so ask Anthropic’s public sector team whether your county is eligible and what it costs. This site doesn’t say your county qualifies, and a government-grade version still doesn’t make red information safe to use without your attorney’s and IT’s written approval. Sources: Claude for Government and Get started with Claude for Government. Checked October 2, 2026.

Free help with election cybersecurity. CISA, the federal cybersecurity agency, offers no-cost election security services, including tabletop exercises (practice drills) and a toolkit. Ask IT whether your county already uses them.

What to skip on a county PC unless IT specifically approves it: connectors to county systems, browser use (Claude in Chrome or ChatGPT’s browser extension), and computer use.

The AI works in a folder you pick. It can create and change dozens of files in a few seconds, and it saves everything it makes right there. Any of these three places works. Pick the one that fits how you work.

On an isolated AI workstation, use the C: drive or an external drive. Signing in to the county OneDrive there would connect that PC to the county tenant, which undoes the isolation above. Your IT staff may also have conditional access rules (Microsoft 365 settings that decide which devices can sign in or sync, like “county-managed PCs only”) that block it anyway.

Wherever you keep projects, file final products in your office’s normal filing system. AI-made work can be a public record, and your records management liaison officer (RMLO) can tell you how long to keep it.

Make one main folder, then a separate folder inside it for each project. This site’s examples call the main folder AI Projects. (I call mine Claude Code Access.) Call yours whatever you like.

AI Projects\
├── Poll Worker Decks\
├── Social Media\
├── Name Badges\
└── Candidate Handbook\

Why separate folders:

• Each project has its own instructions. Each folder can have its own CLAUDE.md, a plain-text instructions file that Claude Code reads at the start of every session, and its own context (the documents and history the AI has in front of it).
• Data from one matter never leaks into another. The AI works in the folder you open. The files for your name badges don’t show up while you work on poll worker decks.
• You can archive or delete a project cleanly. When it’s done, move or delete one folder, as your retention schedule allows.
• Records retention is easier. One folder, one matter. Your RMLO can tell you how long to keep it.

Open the project folder, not the main folder. Claude Code reads the CLAUDE.md in the folder you open and in every folder above it. That means a short CLAUDE.md in your main folder (with the data rules) applies to every project under it. It also means that if you open the main folder itself, the AI can see every project at once. The same goes for ChatGPT: add the project folder to a local project, not the main folder. Folder Projects walks through starting a session on a folder in each app.

Starter folder template

You don’t have to build this by hand. Make the project folder, open it in the app, and the AI will create the rest as it works, especially if the folder has a CLAUDE.md like the one below. Here’s what a project looks like after a session or two:

Candidate Handbook\
├── CLAUDE.md
├── NOTES.md
├── sources\
│   ├── README.md
│   └── candidate-handbook.pdf
└── outputs\
    ├── README.md
    └── DRAFT-lobby-summary.docx

• CLAUDE.md: the instructions and data rules for this project.
• NOTES.md: a running log of each session (what you asked, what was made, who reviewed it), for records.
• The sources folder: the public documents the AI downloaded (or you dropped in). Its README lists where each one came from and the date.
• The outputs folder: everything the AI makes. Its README tracks what was made and who reviewed it.

Here’s a sample CLAUDE.md. Replace everything in brackets, and keep the data rules.

# Project: [Project name]

Office: [Your county] County Supervisor of Elections
Owner: [Your name and title]
Started: [Date]

## Data rules (read these first, every session)
- Public data only in this project. Everything here must be green: already published, or something we would give to anyone who asked.
- Never save or create: voter personal information (names tied to addresses, dates of birth, phone numbers, or emails), voter lists, Social Security numbers, driver license or state ID numbers, signatures, passwords, keys, tokens, or network or security configurations.
- If a file or request looks like it contains any of that, stop and ask me. Don't open it, summarize it, or copy it.
- Work only inside this folder. Don't look for or connect to other drives, systems, or accounts.

## Where things go
- `sources/`: the public documents we work from. When you download one, save it here and add it to `sources/README.md` with the web address and the date.
- `outputs/`: everything you make. Start draft file names with `DRAFT-`.
- `NOTES.md`: add a dated entry for each session: what I asked, what you made, and which files changed.

## How to work
- Get sources from official websites, and tell me where each fact came from, with a link or the file and page.
- If you can't find something, tell me instead of guessing.
- Ask before deleting, moving, or renaming any file.
- Plain language, 8th to 10th grade reading level.

## Review
- A person reviews everything before it is used, published, or sent.
- Nothing in `outputs/` is final until a person marks it reviewed in `NOTES.md`.

Download the starter files:

• Download the whole starter folder (zip), which has every file below. Right-click it and choose Extract All.
• Download the sample CLAUDE.md
• Download NOTES.md, a log template for records
• Download sources/README.md, a source list (save it in your sources folder)
• Download outputs/README.md, a review tracker (save it in your outputs folder)
• Download README.md, step-by-step setup instructions
• Download PROMPTS.md, an empty file for requests you want to reuse
• Download SAFE-USE-CARD.md, a one-page safe use card to keep by the computer

Keep CLAUDE.md short. Anthropic’s guidance is to target under 200 lines per CLAUDE.md file, because longer files use more of the AI’s working space and are followed less reliably. Short, specific rules work best. See How Claude remembers your project.

So far, the AI reaches only what’s in its folder and what you type. The features below stretch that reach. Each one is useful. Each one also lets the AI see more, and most let it act for you.

One term you’ll see: MCP (Model Context Protocol), an open standard for connecting AI tools to outside apps and data. Most connectors and plugins use it. In Claude Code, you’ll usually see them called MCP servers. You’ll also see prompt injection: instructions hidden in a web page, email, or document that try to steer the AI into doing something you didn’t ask for.

“Only sees what I give it” vs. “takes actions”

This is the most useful line to draw when you decide whether a tool is safe for a task.

“Read-only” isn’t the same as “only what I give it.” A connector that can only read your mailbox can still read all of it, including voter correspondence you’d never hand it yourself. Read-only limits what the AI can do, not what it can see.

In the Claude desktop app’s Code tab, Claude Code runs on your computer with your Windows account’s access. Before it edits a file, runs a command, or reaches the internet, it can stop and show you an approval prompt (also called a permission prompt): a box that says exactly what it wants to do and waits for your answer. You can usually say yes once, say yes and don’t ask again for that kind of action, or say no and tell Claude what to do instead.

Why you read every prompt

The prompt is your last chance to stop an action. It only protects you if you read it. Check three things:

1. Where: is it working inside your project folder, or somewhere else?
2. What: is it reading, editing, deleting, moving, or installing something?
3. Sending: is it uploading, emailing, posting, or connecting to a website or system you didn’t expect?

Slow down if you see rm, del, or Remove-Item (delete), mv or Move-Item (move), a web address or curl (reaching the internet), install (adding software), or push or send (sending something out). If you don’t understand a prompt, say no and ask: “Explain in plain English what that command does and why you need it.”

Be careful with “don’t ask again.” It saves time, but you won’t see the next one.

Permission modes

A permission mode sets what Claude Code may do without asking you first.

There are a few other modes, such as one that accepts file edits automatically. You don’t need them to get started.

Pick Manual yourself. Whatever mode is showing when you start, switch to Manual while you learn. In the Code tab, use the mode selector next to the send button; it remembers your choice for that folder. (If you use Claude Code in a terminal instead, Shift+Tab cycles through the modes.) Details: Choose a permission mode.

Codex has its own menu, under the message box. Ask for approval asks before Codex changes files outside the project or uses the internet; OpenAI recommends starting there. Approve for me asks only about actions it decides look unsafe. Full access lets it reach the internet and any file on your computer: never on an office computer. Start with Ask for approval. (OpenAI: permission modes)

Why the dedicated folder matters here too

Claude Code treats the project folder you pick as its working area. In auto mode, its safety check trusts that folder: file edits inside it go through without asking. If you open your whole Documents folder or the C: drive, all of that counts as “inside.” A dedicated project folder keeps “inside” small.

Undo has limits

Made a mistake? With the message box empty, press Esc twice (or type /rewind) to roll Claude’s file edits back to an earlier point. Two limits:

• Rewind covers only edits Claude made with its own file-editing tools. Files a command deleted, moved, or copied aren’t covered.
• Nothing can undo an action outside your computer: an email sent, a form submitted, a post published, a record changed in another system.

That’s why the backup copy and the approval prompt both matter. See Checkpointing for details. Codex in the ChatGPT desktop app has its own settings for what it may do without asking. The names are different, but the habits are the same: most cautious setting first, read every request, one folder per project.

1. 1

   Talk to IT first.

   Before you set up an AI workstation or install any AI app.

2. 2

   Isolated workstation, or an IT-approved desktop app.

   If IT approves, use a separate PC off the county network. If not, use the desktop app on your work PC with IT’s OK, for green information only.

3. 3

   Pick a home for your projects.

   The C: drive, OneDrive, or an external drive. Back up whatever isn’t backed up automatically, and encrypt an external drive.

4. 4

   One folder per project.

   Each with a short CLAUDE.md that says “public data only.”

5. 5

   No connectors or plugins at first.

   Add one at a time, for public data only.

6. 6

   Manual or plan mode while you learn.

   Read every approval prompt before you answer it.