Writing · AI governance

Saying yes to AI, with conditions

Leadership wanted an enterprise AI tool, and they wanted it quickly. The controls around it weren't ready yet.

Security teams usually get two bad options in that moment: block it and watch people use free tools anyway, or approve it and hope. I chose a third: yes, with conditions.

The rules for the pilot

• Local files only. No connections to company systems on day one.
• No data shared with the provider. And the contract had to say the provider could not train on our data. I confirmed it in writing.
• A written AI usage policy. Clear rules for what people could and couldn't put into the tool.
• Logging from day one. If we couldn't see how the tool was used, we couldn't expand it safely.

The hard part was saying "not yet"

Once people saw what the tool could do, leadership wanted to connect it to Microsoft 365 right away. I held that connection until IT had finished securing M365. An AI tool connected to Microsoft 365 can reach whatever its users can reach, so the permissions underneath it had to be right first.

That wasn't a no. It was a sequence.

What happened

The business got its tool. The data stayed protected. Because the guardrails were in place from the start, the pilot expanded company wide with phased system access, backed by an AI security risk review process for new tools and connections.

Security's job isn't to block AI. It's to make yes safe.

How is your organization handling AI tool requests: blocking, approving, or something in between?

← More writing