Shadow AI: start with the work, tools and data
Shadow AI is AI use outside the organization’s approved tools and processes. Start by asking people which tasks they use AI for, which accounts and tools they use, and what information they provide. Record what you find before deciding what to change.
Agree the perimeter and the next decision
Phase 0 covers a Shadow-AI audit, data classification, egress controls, enterprise sign-on, vault-managed secrets and a signed Security Perimeter Document. The readout informs which remediation is necessary for the owner’s risk appetite and whether workshops can begin. Agree the scope before treating any control as deployed.
Build and inspect the controls
In the workshops, participants build and review a Guardian Layer around their workflows. The open specifications provide an inspectable starting point. Agree access, oversight and integration with the security tools already in use, then test those controls against real tasks and exceptions.
Measure actual use
Choose a recurring task and record the baseline before building. Log executions, human review, exceptions and operating costs. Compare observed results with the baseline; separate gross cost avoidance from net ROI. Agree who reviews the evidence and when to change, pause or expand the workflow.