Stop 1 of 9 · Set once
The client Project, at scale
One instruction template filled twelve times, so every client Project answers in the same shape, and a written secrets policy you can hand the client.
One template, twelve Projects
Hazem runs twelve client sites: two law firms, an insurance agency, two contractors, a healthcare practice and the rest smaller. A hundred users, a hundred and fifty endpoints. Building each Project from an empty instruction box gets twelve Projects that quietly disagree about what a good answer looks like.
Write the instruction set once with the client facts marked, then fill it twelve times. Consistency is the smaller half of the win. The larger half is that a difference between two clients becomes readable: same instructions, different answers, so the difference is in the facts.
The template, field by field
| Field | What it holds |
|---|---|
| Identity | Sites, users, endpoints, contract type, covered hours |
| Platform | Domains, identity, MDM, hypervisor, network, VoIP, backup target |
| Standards | Image, patch rings, MFA method, admin model, naming |
| Compliance | The frame, the assessor, the last assessment date |
| Contacts | Roles, never people: change, spend, after-hours |
| Escalation | Severity table, response targets, freeze windows |
| Out of scope | What the contract excludes, so Claude stops proposing it |
Compliance and Out of scope are the fields everyone skips and the ones that change the most answers. A Project that knows Northgate Family Health is HIPAA bound stops offering a consumer file share as a fix.
You support me, Hazem, owner and lead engineer of a managed IT practice. This Project covers one client only: Northgate Family Health. Identity: two sites, 22 users, 34 endpoints, fully managed, covered 07:00 to 18:00 weekdays, after-hours P1 only. Platform: Microsoft 365 with Entra ID, hybrid joined Windows 11 on Intune, two Hyper-V hosts, Meraki MX and switches, hosted VoIP, backup appliance with a cloud copy. Standards: image NG-W11-2026-02, patch rings pilot then broad at seven days, phishing-resistant MFA for clinical staff, admin accounts with no mailbox, devices NG-SITE-NN. Compliance: HIPAA bound, assessed by Verrick Audit in March 2026. When you recommend a control, name the safeguard it maps to and whether it is required or addressable. Roles: practice manager approves change, managing partner approves spend. Escalation: P1 is anything blocking patient care or records access, one hour response. No non-urgent change ships in the last week of a quarter. Out of scope: the practice management application, its vendor hosting, the card terminals. Do not propose work there. Always name the console I run each step in and a check that proves it worked. Flag anything touching identity, mail flow, conditional access or backups as a change needing a window and a note. Never ask for credentials, keys, recovery codes or tokens. Never assume a licence exists until I confirm it. Never propose storing patient data outside this tenant.
The secrets policy, in writing
The instructions tell Claude what not to take. The policy tells your clients and your engineers the same thing, on one page, signed.
Four categories never enter a chat, inside a Project or out of one. Tenant secrets: passwords, keys, tokens, recovery codes, certificates. Live credentials, including the ones sitting in a screenshot of a reset screen. Raw vulnerability output, a target list with addresses attached. Regulated client data: patient records at Northgate, case files at the two firms, claims data at Marren.
Write a one-page AI usage policy for my managed IT practice, aimed at a client who has asked whether we use AI on their environment. Cover what we use it for, the four categories we never put into a chat and why, how we redact before pasting, who reviews AI-assisted output before it reaches the client, and what happens if something slips. Plain language, no vendor marketing, signature block at the end.
The artefact
Two documents a client could be handed today: the filled instruction set, so they see what you told the machine about them, and the signed policy.