Topic starter
14/08/2026 6:35 pm
TL;DR: TaskUs says it enabled AI for 40,000 employees by measuring actual usage first and then enforcing controls where users meet the tool, including browser-level visibility into prompts, files, credentials, and extensions, according to Island. AI is becoming an identity with its own access and tools, so policy-only governance is no longer enough.
Editorial analysis by NHI Mgmt Group, based on content published by Island: “TaskUs Runs on Default Deny. It Still Said "Yes" to AI.”.
Key questions
Q: What breaks when AI systems are trusted without runtime policy enforcement?
A: The model can take actions that look valid but violate business rules, expose restricted information, or trigger unsafe downstream processes.
Q: How does non-human identity governance apply to AI-powered applications?
A: AI-powered applications frequently act through service accounts, API keys, and delegated tokens, so identity governance becomes part of the control model.
Q: How do security teams know if shadow AI is actually under control?
A: Security teams know shadow AI is under control when they can inventory every agent, model workflow, and tool connection, then map each one to an owner and access scope.
Practitioner guidance
- Measure actual AI usage before writing controls Inventory which AI tools, models, modalities, credentials, and extensions employees are already using, including embedded use inside third-party SaaS and browser sessions.
- Enforce controls where the user meets the tool Apply policy prompts, acknowledgement, and access limits at the browser or session layer so controls appear when an employee opens an AI page or workflow.
- Limit AI to company-managed instances Constrain approved use to managed AI services where prompts, uploads, downloads, and extension installation can be governed consistently.
Bottom line: AI governance fails when organisations assume a written policy can control browser-era AI adoption across embedded workflows and personal usage patterns.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/08/2026 6:42 pm
AI governance has crossed from policy management into identity enforcement. The central shift in this article is that AI can no longer be treated as a static application with a documented allowed-use policy. When employees can adopt tools, credentials, extensions, and embedded workflows in the browser, the actual control surface becomes runtime behaviour. Practitioners should read this as a governance redesign problem, not a tooling preference.
A question worth separating out:
Q: What is the difference between controlling AI with DLP and controlling it as an identity?
A: DLP focuses on the content moving in and out of a session, which works best when the prompt is the main attack surface. Identity-based control also governs who or what is acting, which tools are available, and whether the session itself is allowed to proceed. That broader model is needed once AI can behave like a digital worker.
👉 Read our full editorial: AI as an identity shifts control from policy to runtime enforcement