Skip to content

Govern AI usage

Find out what your staff are actually sending to AI tools.

You can't govern what you can't see. Blocking a handful of known domains isn't a policy, and an acceptable-use document isn't a control.

Click through AI Guardian in the Demo Center →

The situation

What this usually looks like

If more than two of these are true, the work below is the work you are already doing by hand.

  1. The AI policy says what is allowed, and nobody knows what is actually happening.

    The policy is a document, not a control.

  2. Blocking the obvious tools moved usage to personal accounts and phones.

    Visibility went down and usage did not.

  3. There is no record of what left in a prompt, so an incident can't be scoped.

    You can say something happened, not what went with it.

  4. The compliance team is being asked about ISO 42001 and the EU AI Act with nothing to show.

    Coverage has to be asserted rather than evidenced.

The mechanism

See, decide, act, and then wait.

Four movements, in order. The fourth is the one that matters: nothing destructive happens without a person releasing it.

  1. 1

    See

    Every destination reached

    Azure OpenAI, Microsoft Entra ID, GitHub Copilot, Microsoft Purview, Okta, a forward proxy or secure web gateway, and the browser extension. Every source is normalised to one event schema and enriched with identity and asset context in under five milliseconds.

    • Azure OpenAI
    • Forward proxy
    • GitHub Copilot
    • Entra ID
  2. 2

    Decide

    Five engines on every event

    Shadow AI, PII detection, prompt injection, UEBA anomalies and behavioural run in parallel. Injection scores against a 0.85 classifier threshold, user risk comes from an Isolation Forest baseline retrained weekly, and PII is detected in content, not assumed from a system boundary. Every finding maps to a MITRE ATLAS technique.

    • Presidio and GLiNER
    • Azure AI Content Safety
    • MITRE ATLAS
    • UEBA baseline
  3. 3

    Act

    Allow, warn, or block, per tool and per group

    Enforcement runs at the forward proxy and the identity layer: Entra's AI-restricted group, session revoke, Zscaler Internet Access, or a SOAR webhook. Every inspection carries a verdict, and an analyst can kill a user's active sessions straight from a blocked one.

    • BLOCKED
    • INJECTION
    • QUARANTINED
    • FLAGGED
    • CLEAN
  4. 4

    Gate

    Evidence, not a questionnaire

    Coverage against the EU AI Act, ISO/IEC 42001, the NIST AI RMF and the OWASP LLM Top 10 is computed from what Guardian actually detects. Raw payloads archive within five minutes with retention up to seven years, so an incident can still be scoped a year later.

    • EU AI Act
    • ISO/IEC 42001
    • NIST AI RMF
    • OWASP LLM Top 10

The gate

What a policy rule can do

Guardian's enforcement rules run at the proxy and the identity layer, scoped per tool, per group and per data class. Each rule carries its own action and its hit count over the last 30 days.

Refused

Block

The prompt doesn't leave the network. The inspection is kept, with the entities that triggered it.

The ruleFrom a blocked verdict an analyst can revoke the user's active sessions in one action.

Waits for a person

Quarantine

Held for review, with the captured payload shown beside its detected entities and a redact or reveal-raw toggle.

The ruleThe classifier score is shown against its 0.85 threshold, so the call is checkable.

Logged only

Alert

Allowed through and recorded as a finding, which moves Open, then Investigating, then Resolved.

The ruleA resolved finding can be re-opened.

Runs on its own

Auto-remediate

The rule acts on its own, moving the user into Entra's AI-restricted group or pushing the change through Zscaler.

The ruleEvery hit is counted against the rule over a rolling 30 days.

A discovered tool carries its own governance state as well: Approved, Under Review, Unauthorized, or Blocked. An approved tool can later be blocked, and a blocked one restored to review.

Who does the work

One agent owns this end to end.

You can turn one on and add the others later. A connector configured for one is available to the rest.

Questions

The things people ask first.

  • Does it read every prompt?

    It inspects prompts at the egress boundary before an external model receives them. The captured payload is shown with detected PII entities highlighted and redacted by default, behind a reveal-raw toggle. What is inspected and how long it's kept is a configuration, not an assumption.

  • Will blocking just push usage to personal devices again?

    That is why discovery comes first. The inventory catalogues every AI tool in use, sanctioned or not, with a risk score, an owner, a department and usage volume, and policy is set per tool, per group and per data class, not as a blanket domain block.

  • How does the compliance coverage work?

    Coverage is computed from what Guardian actually detects, not from answers to a questionnaire. It attests only the controls that AI usage telemetry can satisfy; the remaining controls are organisational or build-time requirements, and it says so instead of claiming them.

  • What is injection detection actually doing?

    A classifier scores the payload and its result is shown against a 0.85 threshold, with the verdict recorded as INJECTION. Findings map to MITRE ATLAS techniques such as Prompt Injection, so the taxonomy is the adversarial-ML one, not a bespoke label.

  • Can we scope an incident after the fact?

    Raw payloads archive to blob storage within five minutes, with retention configurable up to seven years, and the exfiltration map traces flows from users through tools to external endpoints as a graph, a Sankey diagram, or a timeline.

The other outcomes