diniscruz.ai / writing / Development and GenAI

Workshop Plan: User-Driven Semantic Persona Graphs Powered by GenAI

By Dinis Cruz and ChatGPT Deep Research · · 30 min read

PDF LinkedIn post

Contents · 4 sections
  1. Introduction and Workshop Overview
  2. Multi-Phase GPT Pipeline Overview
  3. Technical Implementation Details and GPT Configuration Artifacts
  4. Conclusion and Session Structure

Introduction and Workshop Overview

This workshop will demonstrate how to use Generative AI (GenAI) to build a personalized semantic knowledge graph for a user and then generate tailored outputs for different stakeholder personas. We will guide 6 technical participants (with limited GenAI experience) through a multi-phase pipeline of custom GPT-powered assistants that collaboratively transform user input into meaningful insights. The goal is to showcase the art of the possible – how complex, context-aware solutions can be built by chaining together specialized GPT agents, each performing a focused task.

In this hands-on session (conducted virtually), we will create an MVP (Minimum Viable Product) of an AI-driven guidance tool for a real-world scenario. The chosen scenario is helping a small business assess its cybersecurity posture against a standard (e.g. Cyber Essentials, ISO 27001, or GDPR compliance). The workflow will involve multiple custom ChatGPT “mini-apps” (GPT 1 through 6), each feeding its output into the next. Participants will first see a live demonstration of the end-to-end pipeline using pre-built GPT agents, and then will be supported in creating these GPTs themselves using provided prompt “briefs” and examples. All participants have access to ChatGPT (with Custom GPT capabilities), so they can interact with and configure the agents during the session.

Key objectives and features of the workshop:

Throughout the session, participants will be exposed to GenAI best practices such as providing clear instructions, feeding domain knowledge into prompts, and dividing problems into phases. The overall experience is highly interactive – the GPT agents will interview a participant (or a role-played user), build a knowledge graph, and then produce outputs. We will use manual copy-and-paste between GPTs to simulate data passing (since this is an MVP setup), which keeps things simple and transparent. By the end, attendees will have a concrete understanding of how GenAI (like ChatGPT) can be orchestrated to implement a complex workflow, and they will have hands-on experience creating and tuning custom GPT-based tools.

Multi-Phase GPT Pipeline Overview

To organize the project, we divide the workflow into six phases, each handled by a dedicated GPT agent with a specific role. Below is an overview of each phase and how its GPT will function:

GPT 1: Criteria Ingestion & Questionnaire Designer

Purpose: In Phase 1, we set the stage by ingesting the compliance criteria or standard requirements and automatically designing an interview questionnaire based on them. GPT 1 acts as a questionnaire generator. We will provide it with the details of the chosen standard (for example, key controls from Cyber Essentials) and the objectives of the assessment. GPT 1 will then output a tailored prompt/script for GPT 2 to use – essentially a list of user-friendly questions to ask, plus instructions on how to conduct the interview.

How it works: We supply GPT 1 with background knowledge (e.g. a summary of Cyber Essentials controls) and ask it to produce an interactive Q&A script. This script will include a greeting, about 10–20 questions covering the standard’s key points, and guidance on how to conclude the interview. The questions should be phrased in a clear, non-jargon way despite being based on technical criteria. By automating this step, we show that GenAI can quickly convert official standards or documents into conversational checklists. GPT 1 does not talk to the end-user; it works behind-the-scenes to generate the content for the next GPT. (In the workshop, the facilitator will run GPT 1 beforehand to prepare the material for GPT 2.)

GPT 2: Interactive Q&A Interview Agent

Purpose: GPT 2 is the interactive interviewer that engages with the user (client) to gather information. Using the script from GPT 1, GPT 2 will conduct a chat-based interview, asking the user each question, one at a time, and recording their answers. The goal is to collect all relevant data about the user’s current practices vis-à-vis the standard.

How it works: GPT 2 will be configured with the questionnaire and interview instructions generated by GPT 1. When a user (one of the participants, role-playing a client) starts the conversation, GPT 2 will introduce itself (e.g. as a friendly compliance assistant) and then proceed through the list of questions sequentially. After the user answers a question, GPT 2 will acknowledge and move to the next question, creating an interactive dialogue. It will ensure the phrasing is approachable and will only delve deeper if clarification is needed. Once all questions have been answered, GPT 2 will thank the user and summarize the responses gathered (or at least indicate that it has recorded their answers for processing). This summary of user inputs is crucial, as it will be passed to GPT 3. We effectively end up with a structured set of Q&A pairs or notes about the user’s status on each control. (In the demonstration, we will show this live Q&A. Then, we may have GPT 2 output the collected data explicitly – for example, by prompting it with “Now please summarize the information you’ve collected” – so we can easily copy that text.)

GPT 3: Semantic Knowledge Graph Builder

Purpose: GPT 3 takes the raw answers from the interview and converts them into a semantic knowledge graph representation. In simpler terms, it transforms the Q&A data into structured facts: entities, attributes, and relationships that capture the user’s situation. This step bridges unstructured input and structured knowledge, which is key for complex analysis and traceability.

How it works: We will feed GPT 3 the summary of the user’s answers (from GPT 2) and task it with producing a text-based graph of the information. GPT 3’s system prompt will describe an ontology or format to use – for instance, define the user’s organization as an entity and each security control or practice as either an attribute or linked node with a value indicating its status. The output might be a list of facts or triples like: “Company – has firewall – Yes”, “Company – enforces multi-factor authentication – No”, etc. We won’t require a formal JSON-LD or RDF (to keep it simple), but the idea is to express the knowledge in a structured, machine-friendly way (while still human-readable). This semantic graph makes the reasoning explicit: it’s clear which requirements are met and which are not, and this representation can be fed into the next step. By doing this transformation in a separate phase, we improve explainability and create a durable knowledge asset – a graph that could be visualized or queried in the future. (During the workshop, after running GPT 3, we’ll examine its output – essentially the “knowledge graph” of the user – to verify it captured everything correctly before moving on.)

GPT 4: Detailed Analysis & Recommendations Generator

Purpose: GPT 4 is responsible for producing a comprehensive technical report that analyzes the user’s posture against the standard and provides detailed recommendations. This is where all the knowledge comes together: GPT 4 uses the structured facts (from GPT 3) and the reference standard content to generate an in-depth assessment. It essentially translates the raw graph data into meaningful insights, reasoning about compliance gaps, risks, and mitigations.

How it works: We will configure GPT 4 with an understanding of the scenario and the standard’s guidance. Its input will include the semantic facts from GPT 3 (the knowledge graph of what the user has and lacks) and possibly key reference information from the standard itself (we can provide excerpts or expect GPT 4 to have background knowledge of common practices). GPT 4 will then produce an extensive report. We will instruct it to be structured and factual – for example, to organize the report by control areas or by the questions asked. For each area, it should state what the user has in place (strengths) and what is missing or weak, explain the implications (why it matters for security or compliance), and give specific, actionable recommendations on how to improve. This output is expected to be quite technical and detailed – likely several paragraphs per control topic – since it’s aggregating all relevant insights. Essentially, GPT 4 is performing the role of a consultant or auditor writing a findings report. This phase leverages the knowledge graph to ensure every statement can be traced to input facts (addressing provenance), and by using the standard’s criteria, it ensures alignment with official guidance. The resulting document is the single-source-of-truth that subsequent steps will adapt for different audiences. (In the workshop, we’ll run GPT 4 and skim through the generated report to observe how the AI compiled the information. This also demonstrates how GenAI can synthesize domain knowledge with user-specific data to create a high-quality deliverable.)

GPT 5: Persona-Specific Briefing Generator

Purpose: In Phase 5, we take the heavy technical report from GPT 4 and reframe it for multiple stakeholder personas. GPT 5 will output a set of tailored briefings, each addressing the concerns and communication style of a particular persona in the client’s organization. This is crucial for making the information actionable: different roles (executive vs. technical, for example) need the message presented in very different ways.

How it works: GPT 5 will be given the full technical report (or the key findings) along with descriptions of the target personas. We will define profiles such as:

Using these persona definitions, GPT 5 will generate distinct outputs for each. Each output will highlight the information that matters most to that persona and use an appropriate tone: e.g. the CEO’s summary might use business language and emphasize risk reduction and competitive advantage, whereas the technical plan will use security terminology and detailed steps. We will instruct GPT 5 to clearly separate the sections (perhaps with headings like “Executive Summary”, “Board Briefing”, “Technical Action Plan”, etc.). The ability of GenAI to automatically adapt content to different reading levels and interests is a powerful demonstration of its flexibility. We will also incorporate a persona validation step: GPT 5 will include a short description of each persona’s assumed concerns at the start of each section (for example, “(Persona: CEO – interested in overall business impact and assurance that risks are managed)”), and we can verify with the participants if these assumptions hold true. This ensures the messaging is on point. (During the workshop, after GPT 5 produces the multi-persona document, we’ll discuss how each differs and why. Participants can see how tailoring the voice for the audience makes the recommendations more likely to be understood and acted upon.)

GPT 6: UI/Presentation Prototype Creator

Purpose: The final phase explores how the AI-generated content can be turned into user-friendly visual presentations or interfaces for each persona. GPT 6 will perform “vibe coding” – generating prototype UI designs or code snippets directly from the persona-specific texts. This is an advanced and creative step to end the session on an exciting note, showing that GenAI can not only write documents but also help build applications and dashboards from those documents.

How it works: GPT 6 will be given the outputs from GPT 5 (the tailored briefs) and tasked with producing an appropriate UI or visualization for each. We will prompt it to treat each persona’s content as requirements for a quick interface mockup. For example, GPT 6 could generate:

Using natural language descriptions of the desired outcome, GPT 6 will generate code or design specifications for these UIs. This is the essence of vibe coding – describe what you want, and let the AI handle the implementation details in code. We may see GPT 6 produce actual HTML/CSS/JavaScript for a basic webpage for each persona’s report, or pseudo-code and wireframes. The focus is to illustrate multiple ways to present the same data, optimized for each user’s experience. We won’t necessarily deploy these UIs live in the session, but we will examine the generated code or design and possibly render one quickly (if easily done) to show that it “mostly works.” This technique shows how a clear, structured prompt can yield working software artifacts from AI – an emerging trend in software development. It underlines that with GenAI and the right prompts, we are “only a few prompts away from a product” in many cases.

By the end of GPT 6’s phase, we will have come full circle: starting from a textual standard and ending with interactive tool prototypes, all in one session. This final step typically impresses participants and solidifies the understanding that GenAI can accelerate not just writing tasks but also technical development tasks in a highly accessible way.

Technical Implementation Details and GPT Configuration Artifacts

In this section, we detail how to set up each custom GPT (1 through 6), including example prompt content and instructions. These are the artifacts that will be used to create the GPT agents before the session and will be shared with participants as needed. Each GPT will be configured in ChatGPT with a custom system prompt (and supporting information) as described. Participants can use these as templates for creating their own GPTs.

(Note: In the prompt examples below, placeholders like “[StandardName]” or specific scenario details should be replaced with the appropriate context if a different standard or use-case is used. In our example, we use the Cyber Essentials standard to illustrate, but the structure can be adapted to GDPR, ISO 27001, or others by plugging in the relevant criteria and adjusting the questions.)

GPT 1 – “Questionnaire Designer” Configuration

Role & Objective: GPT 1 is configured as a Questionnaire Designer AI. It reads the input compliance standard and outputs a ready-to-use interview prompt for GPT 2. It must identify the main topics from the standard and formulate clear questions covering each, aiming for about 10–15 questions total. It also appends instructions on how GPT 2 should conduct the interview (one question at a time, friendly tone, etc.). Essentially, GPT 1’s output will be the system prompt for GPT 2.

Inputs: We will provide GPT 1 with the context of the standard’s requirements. This can be done by pasting a summary of the standard or listing its key controls. For Cyber Essentials, for example, we give it the five control themes and any specifics. We also instruct GPT 1 on the format of output we want (a script with numbered questions and any other directions).

System Prompt for GPT 1 (template):

You are an expert AI assistant specializing in cybersecurity compliance. Your task is to help design an interview questionnaire based on the **[StandardName]** requirements. You will be given an overview of the standard’s criteria, and you need to produce a clear, ordered list of questions to ask a user, in order to assess their adherence to those criteria. 

**Requirements:**

- Read and understand the core objectives of [StandardName]. Then formulate a set of about 10–15 key questions that collectively cover all major areas of the standard. The questions should be phrased in a **user-friendly** way (assume the user is technically savvy but not an expert in compliance terms).
- Begin the output with a brief **greeting/introduction** that an interviewer could use (e.g. “Hello, I’m here to help assess your security practices against [StandardName]…”). This sets context for the user.
- After the intro, list the questions in the order they should be asked. Number each question.
- The questions should be open enough to invite brief explanation if needed, but many will effectively be yes/no or short-answer queries. Avoid overt jargon; prefer plain language (e.g. say “Do you have a firewall?” rather than “Have you implemented network perimeter controls?”).
- After listing all questions, include a closing statement thanking the user and indicating that recommendations will follow.
- Additionally, provide any **special instructions** for the interviewer agent (GPT 2) on how to conduct the Q&A. For example: “Ask one question at a time, wait for the user’s answer, then proceed to the next question,” and “If an answer is unclear, politely ask for clarification.” Include these instructions either at the beginning or end of the output clearly, perhaps as a note to the AI.

**Context (Standard Summary):** 
[StandardName] covers the following main points:
- **Use a Firewall** – Protect your internet connection with a firewall.
- **Secure Configuration** – Securely configure devices & software (e.g. remove default passwords, disable unused features).
- **Access Control** – Control user/admin access (least privilege) and use multi-factor authentication for important accounts.
- **Malware Protection** – Protect against viruses and malware (install antivirus or use application allow-listing).
- **Patch Management** – Keep software and devices updated (apply security patches within a defined timeframe, e.g. 14 days for critical updates).

Use the above points to inform the questions. Focus on these areas; ensure at least one question per area (some areas might need multiple questions to cover sub-points). 

Now, produce the interview script with introduction, **numbered questions**, and conclusion, plus any needed instructions for the interviewer.

After providing this system prompt to GPT 1, we (the facilitators) will enter the standard summary as a user message if needed (unless we included it directly). GPT 1 should then output something like the following (abridged for example):

Example Output from GPT 1 (excerpt):

*“Hello! I’m here to help evaluate your company’s security practices against the Cyber Essentials standard. I’ll ask you a few questions about your setup.

  1. Do you have a firewall in place to protect your network’s internet connection?
  2. Is your firewall configured to block unauthorized access attempts by default?
  3. When you set up new devices or software, do you change default passwords and settings to be more secure?
  4. Do you ensure that only necessary services and software are enabled on your computers (to keep configurations secure)?
  5. Do you restrict administrative access to only those who absolutely need it?
  6. Do you use multi-factor authentication for administrator or remote access accounts?
  7. Do you have anti-virus or anti-malware software installed on all systems?
  8. Are users prevented from installing unapproved software on their devices?
  9. Do you apply critical security updates and patches within roughly two weeks of their release?
  10. Do you have a process to ensure all your devices and software are kept up-to-date with the latest security patches?

Thank you for answering these questions. Once we have your responses, we’ll review and provide some recommendations to improve your cyber security according to the standard.

Instructions for interviewer: Ask the above questions one by one in order. After the user answers a question, acknowledge and ask the next one. Maintain a friendly, helpful tone. If an answer is unclear, you may ask a follow-up for clarification. After the last question, provide a brief summary of the responses and thank the user.”*

(The above illustrates the kind of output GPT 1 should generate. We will use this output as the basis for configuring GPT 2.)

GPT 2 – “Interactive Interviewer” Configuration

Role & Objective: GPT 2 is the Interactive Interviewer. It will use the script from GPT 1 to conduct a Q&A with the user. GPT 2’s configuration is mostly about inserting the questionnaire and ensuring it follows the interactive format. Essentially, GPT 2’s system prompt is the output produced by GPT 1 (or a refined version of it).

Setup: We take the script from GPT 1 and place it into GPT 2’s system prompt field. We might need to tweak it slightly for formatting, but generally it will contain the introduction, the numbered list of questions, and the interviewer instructions. We also set GPT 2’s persona to be friendly, encouraging, and clear. GPT 2 will start the conversation on its own with the greeting, then proceed with the numbered questions sequentially, following the user’s input each time.

System Prompt for GPT 2:

(We use the output from GPT 1 directly. For completeness, here is how it would look formatted as a prompt for GPT 2:)

You are ChatGPT acting as a cybersecurity compliance interviewer for the [StandardName] assessment. **Follow the script and guidelines below to interview the user:**

Hello! I’m here to help evaluate your company’s security practices against the [StandardName] standard. I’ll ask you a few questions about your setup to understand where things stand. 

1. Do you have a firewall in place to protect your network’s internet connection?
2. Is your firewall configured to block unauthorized access attempts by default?
3. When you set up new devices or software, do you change default passwords and settings to be more secure?
4. Do you ensure that only necessary services and software are enabled on your computers (to keep configurations secure)?
5. Do you restrict administrative access to only those who absolutely need it?
6. Do you use multi-factor authentication for administrator or remote access accounts?
7. Do you have anti-virus or anti-malware software installed and kept updated on all systems?
8. Are users prevented from installing unapproved or random software on their devices?
9. Do you apply critical security updates and patches within roughly two weeks of their release?
10. Do you have a process to ensure all your devices and software stay up-to-date with the latest security patches?

After you answer all these questions, I’ll summarize your responses and we can discuss recommendations.

*(Instructions for you, the interviewer AI:)* 
- Ask the above questions **one at a time** in order. Wait for the user’s answer before moving to the next question.
- Use a friendly and clear tone. Encourage honesty and let the user know it’s fine if they are unsure or not fully compliant – the goal is to identify areas to improve.
- If an answer is unclear or too brief, you can ask a gentle follow-up for clarification.
- Once all questions are answered, thank the user. Then provide a brief summary of their answers, highlighting any “yes” vs “no” (or strong vs weak) areas, and tell them you will now process this information to generate recommendations.

With this configuration, when GPT 2 is launched in a chat with a user, it will start by outputting the greeting and the first question. The user (in the workshop, one of the participants) will answer, and GPT 2 will continue asking the next question, and so on. Finally, GPT 2 will summarize.

Example Interaction with GPT 2 (for illustration):

I’ll now analyze this information against the Cyber Essentials requirements and prepare some recommendations for you. Please stand by….”

(At this point, the interview is done and we have the summarized data ready to feed into GPT 3.)

GPT 3 – “Knowledge Graph Converter” Configuration

Role & Objective: GPT 3 is set up as a converter that takes the textual summary of the interview (the Q&A results) and outputs a structured semantic representation (a simplified knowledge graph in text form). Its job is to extract the key facts from the interview summary and present them in a consistent, structured format that will be easy for GPT 4 to ingest and reason over.

Inputs: The main input will be the summary of user responses (either copied from GPT 2’s final output or a transcription of the Q&A if needed). We instruct GPT 3 on the schema/format to use for output. This could be as simple as bullet points of facts, or a list of triples. We’ll keep it human-readable for the workshop while still capturing structure. GPT 3 should incorporate relevant context from the standard as needed (like referencing the control names).

System Prompt for GPT 3:

You are an AI that transforms interview responses into a structured knowledge graph format. You will be given a summary of a user’s answers about their security practices. Your task is to output the key facts in a **semantic graph** form – essentially, a list of structured statements about the user’s organization and its security controls.

**Instructions:**
- Parse the input text for specific **facts** or data points. Focus on the security control areas (firewall, secure configuration, access control, malware protection, patch management).
- Represent each fact as a simple relationship or attribute. Use a consistent format for each (for example, you can use bullet points where each point contains one relationship).
- Include the subject (implicitly the user’s company or organization), the aspect being described, and the value/status. For example: “Company uses a network firewall: YES” or “Multi-factor authentication for admin accounts: NO”.
- If applicable, you can format as “<Control/Aspect> – <Status/Detail>”. You can also include brief details if relevant (e.g. “Firewall configured properly: Unknown (using defaults)”).
- Ensure every major question/area from the questionnaire is represented in the output, so we have a complete picture in structured form.
- Do not output prose or explanations – just the structured facts. This is meant to be machine-readable (by another AI) and skimmable by a human.

Now, convert the following interview summary into the structured facts format.

After setting this prompt, we feed GPT 3 the interview summary from GPT 2 as the user message. GPT 3 will then output something like:

Example Output from GPT 3: (assuming the example answers we posited above)

Each bullet captures an atomic piece of information the user provided, in a clear True/False/Partial manner. This is our semantic knowledge graph in text form. It’s essentially a set of attribute–value pairs about the company’s security posture. This structured output is now ready to be handed to GPT 4 for detailed analysis.

(In the workshop, once GPT 3 produces this, we will review it quickly. It shows how the AI has distilled the conversation into a checklist of facts. We’ll mention that in a fully automated pipeline, such structured data could be fed into a graph database or used in code directly, enabling things like traceability and queries. The approach of breaking down into structured data is aligned with making GenAI outputs more explainable and easier to validate.)

GPT 4 – “Technical Analysis & Report Writer” Configuration

Role & Objective: GPT 4 is configured as a Security Analyst/Report Writer. It takes the knowledge graph from GPT 3 and produces a detailed technical report that analyzes each point, measures it against the standard, and provides recommendations. GPT 4 essentially does the heavy lifting of interpreting the data and adding expert insights. This stage will merge the user-specific facts with general knowledge of best practices (and the standard requirements) to generate a comprehensive narrative.

Inputs: We will feed GPT 4 two main things: (1) the structured facts from GPT 3, and (2) context about the standard’s expectations (if not already known by the model). For the latter, we can include a brief reminder of what full compliance looks like for each control. For example, tell GPT 4: “Under Cyber Essentials, multi-factor authentication is required for administrative accounts; firewalls should be properly configured, etc.” This helps ensure the recommendations are precise. GPT 4’s prompt also needs to specify the format of the output (likely a well-structured report with sections).

System Prompt for GPT 4:

You are a cybersecurity analyst AI tasked with writing a detailed technical report based on collected data about a company’s security practices. The company was assessed against the [StandardName] standard. You will be given a list of facts (extracted from an interview) about the company’s current security controls. Your job is to analyze these facts relative to [StandardName]’s requirements and produce a comprehensive report with findings and recommendations.

**Instructions:**
1. **Organization & Tone:** Start with a brief introduction summarizing the context (e.g. “This report assesses Company X’s security controls against [StandardName] criteria based on a recent Q&A.”). Then, create sections or paragraphs for each main control area of [StandardName]. For each area (Firewall, Secure Config, Access Control/MFA, Malware Protection, Patch Management, etc.), detail the findings:
   - What the company has in place (from the facts).
   - What is missing or not up to standard.
   - The implications of any gaps (why it matters, potential risks if not addressed).
   - Specific recommendations to achieve or improve compliance in that area.
2. **Use the Input Facts:** The facts provided are authoritative. Base your statements on them. If a fact is “Firewall: Yes, but defaults used”, acknowledge the firewall exists but note that default config may be weak, and recommend tightening rules. If “MFA: No”, explain that this is a non-compliance and a serious risk, then recommend enabling MFA for relevant accounts.
3. **Incorporate Standard Guidance:** Infuse each section with knowledge of [StandardName] requirements. For example, mention what [StandardName] expects for that control (in simple terms) and evaluate the company against it. You can reference [StandardName] guidelines in the explanation (e.g. “According to [StandardName], all administrator accounts should have multi-factor authentication; currently this is not the case.”).
4. **Detail Level:** Be thorough and technical. Assume the reader of this report is technically proficient (e.g. a security manager or auditor) who wants all the details. Include any relevant technical suggestions (e.g. “Ensure the firewall blocks inbound traffic by default and only allows necessary services like HTTPS and VPN.” or “Implement a centralized patch management tool to automate updates.”).
5. **Format:** Use clear headings or bolded labels for each control domain for readability. You can use bullet points for multiple recommendations in a domain. Ensure the report flows logically from one section to the next.
6. **Conclusion:** End with a short conclusion or next steps section. This could re-state the overall security posture (e.g. “Company X meets many fundamentals of [StandardName] but has two major gaps...”) and stress the importance of addressing them, possibly noting any benefits (reduced risk, certification readiness) if improvements are made.

**Data from the Assessment (Facts):**
- Company has a network firewall: Yes
- Firewall configured with default rules: Yes (potentially weak)
- Default passwords on new devices: No (they are changed; good practice)
- Unnecessary services disabled: Yes
- Admin accounts restricted to few: Yes
- Multi-factor auth for admin accounts: No (currently not in use)
- Anti-malware installed on all systems: Yes
- Users cannot install unapproved software: Yes
- Critical patches applied within 14 days: No (patching sometimes takes ~30 days)
- Update process coverage for all devices: Partial (no automated centralized system)

Using the above facts, generate the technical report as described.

When GPT 4 receives this, it will compose a detailed report. We expect a structured output, for example:

Example Outline of GPT 4 Output:

This report will likely be several paragraphs long, full of technical insight but tailored to the standard’s criteria. It effectively combines the factual graph with domain expertise, providing the “single source of truth” narrative that we can now repurpose.

(During the workshop, after GPT 4 produces the report, we’ll highlight how comprehensive it is and how it draws on both the user’s data and the standard’s knowledge. We can mention that such a report would normally take an analyst significant time to write, but the AI did it in moments. We’ll also caution that one should always review such output for accuracy – an important training point – but in our case it should be largely on target due to the guided prompts.)

GPT 5 – “Persona Briefings Translator” Configuration

Role & Objective: GPT 5 is configured as a Persona-Specific Communication Assistant. It takes the technical report from GPT 4 and produces multiple outputs, each tailored to a different audience persona (CEO, Board, CFO, Technical team, etc.). Essentially, GPT 5 acts as a translator and summarizer, reshaping the tone and content while preserving the core findings. This phase demonstrates delivering the right message to the right stakeholder.

Inputs: The primary input is the full technical report from GPT 4. Additionally, we will provide GPT 5 with a definition of each target persona, so it understands their perspective. This can be part of the system prompt or given as a separate “context” block. We should clearly enumerate the personas and what each cares about:

System Prompt for GPT 5:

You are an AI communications expert who can rewrite technical content for different target audiences (personas) while highlighting the information that matters most to each. You will be given a detailed technical report about a company’s security assessment. Produce a separate briefing for each of the following personas:

**Personas:**
1. **CEO (Executive)** – Audience: Chief Executive Officer. Not technical. Interested in overall risk to business, strategic importance, and reassurance that things are under control. Briefing should be high-level, concise (a few paragraphs or bullet points). Focus on business impact of findings and the value of recommended actions (e.g. “improve security to avoid downtime, protect reputation, ensure customer trust”). Use minimal technical jargon.
2. **Board of Directors** – Audience: Board members (non-executives). They care about governance, compliance, and risk oversight. Briefing should be one page or less, very high-level. Emphasize whether the company meets standards or has gaps, and what the plan is to fix them, in terms of risk management. Possibly use slightly formal tone.
3. **CFO (Finance Executive)** – Audience: Chief Financial Officer. Focus on financial and compliance impact. Briefing should translate findings into cost/risk terms: potential financial losses if gaps aren’t fixed, costs of mitigation vs. benefits, and any compliance obligations (e.g. certifications, avoiding fines). Keep it executive-level but include numbers or budgets if relevant (we can estimate qualitatively if needed, like “low-cost improvement” or “investment in MFA is minimal compared to risk of breach”).
4. **IT/Security Team Lead** – Audience: Head of IT or Security. Technical professional who will implement the changes. Briefing can be more detailed (but still summarizing the big report). Focus on action items: what needs to be done, why it’s important (in technical terms), and perhaps some implementation hints. This can be presented as a list of recommendations or a short action plan. It should still be readable (not just raw checklist – give context for each action). Use some technical language appropriate to an informed practitioner.
*(Optionally)* 5. **IT Engineer/Administrator** – Audience: the person who will carry out the tasks (if different from lead). This could be an even more granular set of steps or a checklist derived from the Team Lead’s plan, phrased as direct instructions. (Include this persona if granular detail is desired.)

**Task:** For each persona above, write a tailored version of the **same underlying content (the security assessment findings and recommendations)**. Preserve factual accuracy but adjust the depth, tone, and framing. You should effectively **translate** the technical report for each audience:
- The CEO and Board versions should be short, focusing on the big picture and risk/status (e.g. “We are mostly compliant but have two important gaps. Plan in place to fix within 3 months. This will reduce risk of X by Y.”).
- The CFO version should mention financial implications, perhaps in terms of risk cost or budget required (even if roughly).
- The IT/Security Lead version should be action-oriented: enumerating what to fix and perhaps referencing the standard for justification (e.g. “Enable MFA on admin accounts – this is required by Cyber Essentials and will greatly reduce account breach risk.”).
- If providing the Engineer checklist, make it a clear list of tasks (like “1. Enable MFA on all admin accounts (tools: e.g. Duo, Authy, or similar). 2. Implement a patch management policy to deploy critical updates within 14 days...” etc.).

Clearly label each output section with the persona it’s intended for (e.g. start with a heading or bold title for each persona).

Now rewrite the content for each persona. The input technical report is below.

(After this prompt, we would input the full text of the GPT 4 technical report as the user message for GPT 5.)

GPT 5 will then generate multiple sections, each prefaced by the persona name. We expect something like:

Example Outputs from GPT 5 (summarized):

As seen, each of these outputs is derived from the same base information but framed very differently. GPT 5 thus provides the ready-made communications for various stakeholders, which is incredibly useful in real-world settings.

(In the workshop, we will review these persona outputs and possibly discuss whether they hit the mark, letting participants observe how well the AI adapts content. We may even have participants suggest tweaks or additional personas to test GPT 5’s flexibility, time permitting.)

GPT 6 – “UI Prototype Generator” Configuration

Role & Objective: GPT 6 is configured as a UI/UX Prototype Generator, leveraging vibe coding principles. It takes the persona-specific content (from GPT 5) and generates suggestions for UIs or visual presentations that would effectively convey that content to the respective personas. The aim is to end up with, for example, sample code for a dashboard, or HTML for a report, or a description of a slide deck. This shows how we can go from narrative to application with AI assistance.

Inputs: The inputs will be the outputs from GPT 5 for each persona, or a selected subset. We might do one persona at a time with separate runs, or instruct GPT 6 to handle all in one go. Given time, we might pick two personas to demonstrate: say the CEO (for a dashboard) and the IT team (for a detailed web report or checklist UI). If doing all in one, we need to be clear in the prompt for GPT 6 about organizing its output per persona and possibly specifying the format (code vs description). We also include any guidelines about the tech (if we prefer HTML/CSS, etc.).

System Prompt for GPT 6:

You are an AI software developer and UX designer. Your task is to create simple UI prototypes based on the briefing content for different personas. We have textual briefings for several personas (CEO, Board, CFO, IT Lead). Now, imagine how to present the key information to each persona in a **user interface or visual format** that best suits their needs, and provide either a description or sample code for it.

**Instructions:**
- For each persona briefing given, propose an appropriate UI design. You can provide this as:
  - **If code is requested:** a snippet of HTML/CSS/JavaScript that could represent a dashboard or interface for that persona, using dummy data from the briefing.
  - **If description is fine:** a clear description of a slide or interface, possibly with pseudo-visual elements (like “[Chart: compliance score]”).
- Tailor the style to the persona:
  - **CEO Dashboard:** Perhaps a one-page web dashboard with a few key metrics (e.g., a big compliance percentage, a green/yellow/red status indicator for overall security, and 2-3 bullet points of top risks or actions). Use simple visuals (icons, colored text for status). Provide HTML/CSS for layout if possible.
  - **Board Presentation Slide:** Possibly a PowerPoint-like single slide outline. Since code for PPT isn’t straightforward, just describe: e.g., title, a bullet list of the two gaps and actions, maybe an infographic icon. (Or if using HTML, simulate a slide with divs and styles).
  - **CFO Report View:** Perhaps a small table or chart showing cost vs risk. Could be a section in the dashboard that highlights cost analysis. For code, maybe a table element with two columns (issue vs potential cost).
  - **IT Team Tool:** An interface that looks like a task tracker. For example, a checklist UI where each recommendation is a checkbox item. Or a simple web page listing actions with status toggles. Provide a structured HTML list with checkboxes for each action item (MFA, patching, etc.), possibly with an expand/collapse for details.
- The UIs should be **simple and self-contained**. We’re not implementing full functionality, just showing the look. Use placeholder values (e.g., “75% compliant” or “MFA: Not Implemented” in red text).
- Comment your code (if any) to explain what each part is (for clarity to the participants).
- Clearly separate each persona’s UI output, e.g., start with a comment or heading naming the persona.

Now, I will provide the persona briefings. Please produce a UI prototype (code or detailed description) for each.

(After this prompt, we feed in the content of the persona briefings from GPT 5 as the user message, or instruct GPT 6 to refer to them abstractly if too long. We might do them one at a time to avoid context length issues.)

For example, let’s say we do the CEO and IT Lead as two separate requests for brevity. For the CEO, GPT 6 might output:

Example GPT 6 Output for CEO (Dashboard HTML snippet):

<!-- CEO Dashboard Prototype -->
<div style="font-family:sans-serif; max-width:600px; margin:20px;">
  <h2>Cyber Essentials Summary – Company X</h2>
  <div style="font-size:48px; font-weight:bold; color:green;">
    80% Compliant 
  </div>
  <p>Status: <span style="color:orange; font-weight:bold;">Partial Compliance</span></p>
  <ul>
    <li>✅ Firewall, Secure Config, Anti-malware in place</li>
    <li>⚠️ Multi-Factor Authentication <strong>not yet implemented</strong> (planned)</li>
    <li>⚠️ Patching delays (updates sometimes >30 days)</li>
  </ul>
  <p><em>Risks are being addressed to improve security and achieve full compliance.</em></p>
</div>

(The above code, if rendered, would show a simple dashboard with a compliance percentage, a status indicator, and bullet points with checkmarks and warning signs for good vs. needs improvement. GPT 6 might also give a short explanation of the design choices in comments or text.)

For the IT Team interface, GPT 6 might output something like:

<!-- IT Team Action Items Prototype -->
<div style="font-family:sans-serif; max-width:600px; margin:20px;">
  <h2>Security Improvement Plan</h2>
  <ul style="list-style-type:none;">
    <li>
      <input type="checkbox" id="mfaTask"> 
      <label for="mfaTask"><strong>Enable Multi-Factor Authentication</strong> for all admin accounts 
      <span style="color:red;">(Pending)</span></label>
      <p style="margin-left:20px; font-size:0.9em; color:#555;">Using Azure AD or similar, require MFA for IT admins and remote access users. <br>**Due:** 4 weeks</p>
    </li>
    <li>
      <input type="checkbox" id="patchTask"> 
      <label for="patchTask"><strong>Enforce 14-day Patch Window</strong> for critical updates 
      <span style="color:red;">(Pending)</span></label>
      <p style="margin-left:20px; font-size:0.9em; color:#555;">Implement WSUS or patch management tool to automatically deploy updates within 2 weeks of release. <br>**Due:** Ongoing (policy change)</p>
    </li>
    <li>
      <input type="checkbox" id="fwTask" checked> 
      <label for="fwTask"><strong>Review Firewall Configuration</strong> 
      <span style="color:green;">(Completed)</span></label>
      <p style="margin-left:20px; font-size:0.9em; color:#555;">Checked firewall rules, now default deny inbound, only required ports open.</p>
    </li>
  </ul>
</div>

This HTML snippet creates a simple checklist of tasks with checkboxes, status in color, and some details indented. It’s an example of an engineer-friendly UI where they can tick off completed tasks and see what’s next. GPT 6 may also describe that “✅ means completed, red text means pending, etc.”

For other personas, GPT 6 might not write code but rather describe a PowerPoint slide or a chart. Since HTML is easy to show, we focused on that. The key is that GPT 6 demonstrates generating interface code from instructions, underscoring how AI can help with rapid prototyping and even building tools directly.

(In the workshop, we can show the raw output of GPT 6 (code), and perhaps quickly copy it into a browser or codepen if feasible to show it renders correctly. Even without live rendering, reading the code and imagined UI will be illustrative. We’ll note that this “vibe coding” approach allows someone with an idea (like “I want a dashboard for this data”) to get a working starting point from AI very quickly, which is a powerful capability in modern development. Participants will thus see the full journey from data to end-user presentation.)

Conclusion and Session Structure

We have outlined a comprehensive project plan that takes the participants through building User-Driven Semantic Persona Graphs step by step. The workshop will proceed as follows:

By the end of the session, the participants will have a concrete example of GenAI-driven development: from raw text to a knowledge graph to stakeholder-specific insight, and even UI prototypes – all done rapidly with AI assistance. This not only trains them on GenAI capabilities but also sparks ideas on how they can apply similar patterns (e.g. breaking problems into GPT phases, using AI to generate code) in their own technical domains. The comprehensive plan and provided GPT prompt artifacts will ensure the workshop runs smoothly and delivers maximum value in illustrating the “art of the possible.”

Sources:

Released under CC BY 4.0. First published on docs.diniscruz.ai; this page as markdown.

← The Hidden Cost of Ephemeral Testing and the Case for AutomationBridging Niklas Luhmann's Ideas with Semantic Knowledge Graphs and G³ →