Make the safe option easier than the shortcut

To get your teams to stop pasting sensitive data into AI, don't add one more rule: make the safe option easier than the shortcut. A behavior needs three things — motivation, ability, prompt (BJ Fogg's model). Motivation fluctuates and doesn't scale; the reliable lever is ability: lower the effort of the right move until it becomes the default path. When anonymizing costs nothing, the shortcut has no reason to exist.

Why rules alone fail

A policy puts all its weight on motivation: “remember to anonymize.” But motivation is exactly what gives out at the wrong moment — under a deadline, at the end of the day, when the shortcut saves five minutes. Asking for more discipline means fighting human nature on every message. That's a fight you lose at the scale of a team.

The lever that scales: ease

In the equation behavior = motivation × ability × prompt, acting on ability is what holds. The EAST principle sums it up: to make a behavior stick, first make it Easy. If the right move takes zero effort and the wrong one takes some, the trade-off flips on its own — without banning anything, without watching anyone.

• Lower the activation energy: the right move should be the cheapest, not the most virtuous.
• Remove the decision: what doesn't have to be decided can't be forgotten.
• Keep freedom: you guide with the default, you don't forbid.

Make the safe option the default

People overwhelmingly follow the pre-selected option (default effect) and prefer not to change the state of things (status-quo bias). These two forces, usually suffered, become allies the moment you put them on the right side: if anonymization is the default behavior — automatic, ahead of sending — then doing nothing means being protected. The shortcut disappears because there's no shortcut left to take.

Set up the right default

1. 1Tool up instead of lecturing: deploy an engine that anonymizes sensitive data before sending.
2. 2Make anonymization the default path, not an optional checkbox.
3. 3Choose frictionless protection: automatic detection, browser-side restoration, zero manual steps.
4. 4Measure usage, not goodwill: a well-set default shows up in the facts, not in reminders.

ONYRI Sanitize is built to be that default: detection and masking happen upstream, the mapping stays in the browser, and the answer is restored locally. The right move stops depending on each person's vigilance — it becomes the path of least effort.