On the eve of the autumn fair, the La Ribera neighborhood association received a short, alarming call. Someone introducing herself as a city technician said she needed the volunteer roster “to cross-check shifts for safety.” The person who answered did not know whether the request was genuine, exactly what information the file held, or whether there was another way to meet the urgent need. Fortunately, a decision card the group had prepared weeks earlier sat beside the phone. It was not a forty-page cybersecurity manual. It contained four questions and one rule: before turning on a control or sharing information, pause long enough to know what is being protected and what other route is available.
The card did not tell anyone to distrust everything, and it did not replace the judgement of the person answering. It turned a confusing call into proportionate checks. What asset is at stake? The roster held names, phone numbers, availability, and a few accessibility notes. What relationship supports the request? It involved local government, but the voice on the phone did not prove it represented that office. What would disclosure do? It would expose information from people who had not agreed to this use. What alternative would meet the need without opening the file? Confirm the request through the published channel and, if it was real, provide only the necessary shifts through an already known contact.
A pause that does not stop the work#
Small organizations often name an incident too late. Something involving data, access, or a lasting decision is called an “unexpected issue,” an “urgent question,” or a “quick favor.” Pressure rarely arrives as a dramatic attack. It arrives as someone awaiting an answer, an event tomorrow, and a sentence asking people not to make things complicated. A pre-decision card does not turn an association into a rigid office. It makes visible the instant when speed can push people into a decision that nobody can later explain.
Small organizations often name an incident too late. Something involving data, access, or a lasting decision is called an “unexpected issue,” an “urgent question,” or a “quick favor.”
The important part is to ask the questions before choosing a control. Starting with “Which password should we set?” or “Who should get permission?” makes the task seem like a technical selection. Yet the right control for the wrong asset solves nothing. Perhaps the problem is not securing a document with a new link; it is keeping the entire document from travelling when three names and two time slots would do. Perhaps temporary access for an unfamiliar person is unnecessary; perhaps the organization can ask the public body to confirm the need through its institutional mailbox.
The pause must be brief and usable. A four-question card does not require a meeting whenever someone asks for a contact list. It does require the person taking action to write, even in two lines, what the other party needs and why the chosen path is the least intrusive one that still serves that purpose. That small note also keeps an emergency exception from becoming routine simply because it worked once under pressure.
Name the asset precisely#
Saying “it is data” is better than ignoring it, but it is still too general for a sound decision. La Ribera's roster was not a single thing. It combined contact details, weekly availability, activity skills, and notes people had offered so they could participate: whether they needed text messages, could not carry weight, or preferred not to receive late-night calls. Each part had a different sensitivity and a different use at the fair.
Once the group separated those pieces, it found an option it had not seen before. The city office only needed to know how many people could cover a particular slot. It did not need personal phone numbers, health-related notes, or the full calendar. The association could make a volunteer call through its own channel and return an aggregate confirmation. If coordination with named individuals later became essential, each person could decide whether to accept direct contact. Naming the asset did not lead to protecting everything with the same intensity; it made it possible to share less for an understandable reason.
The same distinction works for things that are not personal information. It might be a key to a room, a social-media account, a supplier list, or a budget file. The useful question is what makes that resource valuable or vulnerable in this situation. A storeroom key does not call for the same response as an account with payment permissions. A public event leaflet does not deserve the same handling as a spreadsheet containing reports about children. The card offers no magic categories. It requires people to describe the object before reacting.
Verify the relationship, not the appearance#
The second question can feel awkward because real relationships often show imperfect signals. Someone may call from an unfamiliar number because they are away from the office; a supplier may use a new address after a reorganization; a colleague may ask for help from a personal account when a phone fails. The card does not instruct people to reject everything that looks unfamiliar. It asks them not to mistake a familiar appearance for a confirmed relationship.
At La Ribera, someone remembered that the council office had a published email address and switchboard number. The response was simple: thank the caller, explain that the roster is not sent by phone, and return the contact through the channel the association already knew. That protected both the volunteers and the caller, if she really was who she said she was. It was not a test or an accusation. It was a verification that anyone could repeat and review.
The card should give examples of enough relationship: a request from a known institutional channel, confirmation from the usual responsible person, or a reference that can be checked without using the requested information. It should also state what is not enough on its own: a claimed emergency, a signature with a copied logo, knowing someone on the team by name, or insisting that other associations have already shared the information. A relationship is established through a checkable path, not by the force of a story.
Look for an alternative before opening the door#
The final question changes the card from a brake into a service tool: what alternative delivers the result without exposing the whole asset? If the only answer is “none,” sharing may be necessary; then it should happen through a channel and scope suited to the risk. More often, better options appear once people must state the purpose of the request.
For the roster, the alternatives were a voluntary call-out, an aggregate availability figure, and consented individual contact. In other cases they might be a screenshot of non-sensitive information, an expiring link, two people present during a task, a demonstration using fictional information, or postponing an action until confirmation arrives. None of those measures is virtuous by itself. Its value comes from preserving the purpose without adding unnecessary harm.
Alternatives also reduce the emotional burden of saying no. A person receiving an urgent request can more easily say, “I cannot send the full roster, but I can confirm this afternoon's shifts,” than simply shut the door. The conversation changes from a defensive refusal to a responsible proposal. Security stops looking like an obstacle unrelated to the association's mission.
Make the card a shared practice#
A card stored in a drawer protects nothing. La Ribera's works because it is beside the phone, appears in the coordination channel, and is revisited after real situations. The group does not inspect every call as though it were an audit. Once a month it picks a decision involving data, access, or time pressure and asks: did we name the asset well, verify enough relationship, find a less intrusive alternative, and discover a question missing from the card?
That review can reveal organizational problems. If people are always unsure who can authorize an exchange, the problem is not that volunteers are too cautious; a named contact or a clear confirmation route is missing. If many people share files because they know no other way to coordinate shifts, the association needs a more suitable tool or process. The card should improve through these lessons rather than remain a generic reminder to “be careful.”
It also matters to explain the card to everyone who helps. Volunteers should know they can ask for a pause without being treated as the people who slow down the work. An agreed phrase—“before we send it, let us run the card”—is enough to normalize it. The person asking the question is not accusing the requester; they are caring for a choice that affects other people.
The next time your group receives an urgent request, do not start by looking for the share button or the fastest setting. Write four lines: what asset is requested, what relationship is confirmed, what harm you would avoid, and what alternative keeps the service working. You probably will not need a perfect answer. You will need one you can explain tomorrow to the people whose data, time, or trust was at stake. That is the modest, decisive purpose of a pre-decision card: it gives a team one moment to choose before urgency chooses for it.
