ToolsPrint or save as PDF

Tools you can keep

Four one-page cards, drawn straight from the lessons. Print them and pin them by the desk, or keep them as a checklist before you point an agent at real work. They're the course's disciplines in a form you can use without re-reading the lesson each time — the judgment still stays with you.

Card 1

The redact checklist

From lessons 1.4 and 2.4 — the data question, and identity-blind where it matters.

Before an agent touches other people's data, ask the custody question, then strip what the job doesn't need. Redaction is the floor, not the roof — do it, and still test for the bias that rides in on proxies (Card 3).

The data question, first, every time: whose data does this touch — mine, or someone who trusted me with it? Where does it go once the agent has it? Who can reach it, and under whose laws?

Strip before you process — feed only job-relevant content

Identity — name, photo, date of birth or age, home address. If the task is "match skills to a role", none of these are inputs.
Protected-attribute signals — gender, ethnicity, marital or family status, nationality, religion. Leave them out unless the role genuinely requires them.
Remember the limit — bias leaks back through proxies you can't redact: school, postcode, employment gaps, writing style. Redaction is necessary, not sufficient.

Never paste personal data into a public LLM. The Privacy Commissioner has said your security duty (IPP5) covers the information you type into an AI tool. "We just pasted the CVs into a chatbot" is the sentence that should stop you cold.

Working with Māori data: information about Māori individuals, whānau, hapū or iwi carries data-sovereignty obligations — the principle that Māori data should sit under Māori governance. An agent ingesting it deserves a conversation with the people it belongs to, not a default setting.

General education, not legal advice. If real exposure is on the line, talk to a qualified lawyer about your circumstances.

Card 2

The criteria template

From lesson 2.3 — criteria, not vibes.

Write the criteria first, in your own words, before the agent runs. Criteria chosen after the fact just justify the answer you already have. The agent returns evidence against these — not a score, not a verdict.

This agent judges / decides…

The criteria — job-relevant, and only these

The agent returns…

Evidence and rationale against each criterion — including where it's unsure — not a score, ranking, or recommendation to agree with.

The person who decides (and could say no)…

A person handed evidence weighs it; a person handed a verdict rubber-stamps it. Criteria are what make the human gate real.

Card 3

The bias-probe method

From lesson 3.2 — testing your agent.

For any agent that judges people, you can't tell if it's fair by looking. Measure. Two tests, on your own agent, before you trust it — and again as the tools underneath it change.

1 · The name-swap probe

Take one application. Run it. Note the outcome.
Change only the name — swap a male name for a female one, an obviously Pākehā name for an obviously Māori, Pasifika or Asian one. Change nothing else.
Run it again. Does the outcome move? Repeat across a batch.
If it moves, identity you thought you'd stripped is leaking through proxies. Document it.

2 · Adverse-impact test

Measure outcomes across groups over a real batch — who the agent advances, who it filters out.
Flag: the four-fifths (80%) rule — if a group's selection rate is under 80% of the highest group's, that's the established signal. (A US employment-law rule of thumb — a measuring stick, not New Zealand law.)
In New Zealand the legal frame is indirect discrimination under the Human Rights Act: a neutral-looking practice that falls disproportionately on a protected group can be unlawful even with no intent.

If the skew won't come out no matter what you adjust, that's not a failed build — it's the build telling you the honest answer: some decisions about people shouldn't be automated at all.

General education, not legal advice.

Card 4

When an AI reads your CV

The candidate one-pager — because everyone is, at some point, on the other side of someone else's agent. Share it.

There's a decent chance your next application is read first by a machine. You have more say than you think — but most of it is before you hit send.

Submit less — unless a role genuinely requires it, leave off

Date of birth and age · a photo · your home address (a city is plenty) · marital or family status, nationality, religion.

Format so a machine reads you fairly

Plain structure and clear headings — no text buried in images or columns a parser will scramble.
Name the skills the role asks for, in plain words. Machines match; they don't read between the lines.

Ask three questions

"Do you use AI or automated tools to screen applications?"
"What happens to my data — is it stored, for how long, and does it go to an outside service?"
"Can I ask for a human to review the decision?"

Your rights, honestly. In New Zealand: you can ask to see and correct the information held about you (IPP6/7), and complain of discrimination under the Human Rights Act — but there's no specific right to object to a purely automated decision. In the EU: stronger rights over solely-automated decisions — human intervention, your point of view, an explanation, and to contest it (GDPR Art 22).

Once you've submitted, your control is limited, and there's no practical way today to trace where a CV travels — so the real leverage is before you send. General education, not legal advice.

← All lessons Start the primer →