Before you touch a single AI tool, build a personal map of what is actually approved for use at your agency. Not what your friend uses at a different agency. Not what the news says. What your CIO has signed off on.
By the end of this lesson you will have a one-page document listing every AI tool approved for your role at your agency, the data classifications you can use them with, and the authoritative source for each entry.
Federal and state employees keep getting in trouble with AI not because the tools are bad, but because nobody bothered to write down which tools are approved for which kind of data. This lesson fixes that. We will walk through the four canonical sources of approval — GSA, DoD Tradewind/Pathfinder, OMB memos, and your agency's own AI use case inventory — and you will leave with a personal approved-tools map.
The General Services Administration maintains the government-wide procurement vehicles for AI. The most important entry points are the GSA Multiple Award Schedule (MAS) AI category and the FedRAMP Marketplace at marketplace.fedramp.gov. A tool listed on FedRAMP Marketplace at the Moderate baseline can generally be used for sensitive but unclassified data; Low baseline is for public information only; High baseline is required for data with significant impact if compromised.
The fastest sanity check: search the FedRAMP Marketplace for the vendor name. If the tool is "In Process," it is not yet authorized — do not use it for any government work. If it is "Authorized," note the impact level and the agencies that issued the Authority to Operate (ATO).
Department of Defense civilians have a parallel ecosystem. The Tradewind Solutions Marketplace (tradewind.kessel.run) is the DoD's curated catalog of AI/ML solutions, run by the Chief Digital and Artificial Intelligence Office (CDAO). Tools that have completed Tradewind solution challenges have been pre-vetted for DoD use cases.
Bo, the Pathfinder program is separate — it is an ATO accelerator that lets components inherit security controls from a DoD-wide assessment, dramatically shortening the runway from "interesting tool" to "approved tool." If you are a DoD civilian and the tool you want is not in Tradewind, ask your component AI lead whether a Pathfinder pathway exists.
OMB Memorandum M-24-10 ("Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence," issued March 2024) requires every CFO Act agency to designate a Chief AI Officer, publish an AI strategy, and maintain a public inventory of AI use cases. It also defines "rights-impacting" and "safety-impacting" AI — categories that trigger heavier minimum risk-management practices.
The follow-up OMB M-25-21 updates the framework in light of the 2025 executive order revisions. Read both. The combined effect is that any AI use you start at work must be eligible for inclusion in your agency's inventory; if it is not, you should not be doing it.
Every CFO Act agency posts its AI inventory under ai.gov/inventory or its own /ai page. Look for your agency. The inventory tells you what use cases have already been approved, who owns them, and what risk tier they were filed under. If a use case looks similar to what you want to do, you have a pre-cleared template to reference.
Open a blank document and write five columns: Tool, Source of approval, Highest data class allowed, Where evidence lives, Last verified. Then walk this exact prompt through Claude (or any approved chat AI), one tool at a time:
I am a [GS-13 program analyst at the Department of X / state agency Y / DoD civilian at component Z]. I want to use [TOOL NAME] to [specific task]. For this tool: 1. What is its current FedRAMP status (Low / Moderate / High / In Process / not listed)? 2. Is it on the GSA AI category schedule, the DoD Tradewind Marketplace, or my agency's AI use case inventory? Cite the URL. 3. What is the highest data classification it is approved to handle (public, CUI, FOUO, Secret, etc.)? 4. What public OMB or NIST guidance applies (e.g. M-24-10, NIST AI RMF 1.0)? 5. Tell me what to verify with my CIO before using it. If you cannot verify any of the above with a source, say "unverified" — do not guess.
Take whatever Claude returns and verify each citation yourself. The tool will sometimes confidently invent a FedRAMP status or memorandum number; this is exactly the kind of training-data drift the OMB memos exist to prevent. Trust the URL, not the chat output.
Pitfall 1 — "Free tier" is not approved. A consumer ChatGPT or Gemini account is not an authorized federal system. OMB M-24-10 requires AI in government work to be inventoried and risk-managed. Free public chat tools cannot satisfy that.
Pitfall 2 — CUI handling. Controlled Unclassified Information (32 CFR Part 2002) cannot be pasted into a tool that lacks a Moderate-baseline FedRAMP ATO covering CUI. If in doubt, treat the data as CUI and ask your Information System Security Officer.
Pitfall 3 — Cross-agency inheritance is not automatic. Just because Agency A has an ATO for a tool does not mean Agency B can use it. ATOs are agency-specific unless the tool is on the FedRAMP authorized list and your agency issues its own ATO letter.
Always check with your CIO, IG, or OGC before relying on this lesson for any production decision. This material is general guidance, not legal advice for your specific agency or role.
Before moving on, make sure you can answer: