Topic starter
05/07/2026 6:56 pm
TL;DR: GenAI policy management remains hard because teams must set risk thresholds for novel behaviours across dynamic inputs and outputs, according to Lakera’s product update. Opinionated starting policies reduce blank-slate effort, but they also make policy design a governance decision, not just a tuning exercise.
Editorial analysis by NHI Mgmt Group, based on content published by Lakera: “How to Secure Your GenAI App When You Don’t Know Where to Start”.
Key questions
Q: How should teams choose a starting policy for GenAI applications?
A: Teams should select a starting policy based on the application’s exposure, user audience, and tolerance for false positives.
Q: Why does a single sensitivity setting matter in GenAI policy management?
A: A single sensitivity setting turns risk appetite into an enforceable operational decision.
Q: What goes wrong when teams start GenAI policy management from a blank slate?
A: Blank-slate policy design slows deployment, increases the chance of inconsistent thresholds, and pushes teams toward either overblocking or undercontrolling behaviour.
Practitioner guidance
- Define use-case policy baselines Map each GenAI deployment to a starting policy category before teams begin tuning, so the first control reflects the use case rather than individual preference.
- Document the sensitivity threshold decision Record why L1, L2, L3, or L4 fits the workflow, the risk appetite, and the expected operational friction for that application.
- Run policy in observation mode first Use non-blocking logging to see how the application behaves in production before enforcing flags or hard blocks.
Bottom line: GenAI policy management is becoming a governance discipline because the starting policy now shapes how risk is controlled throughout the application’s life cycle.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
05/07/2026 7:18 pm
Opinionated controls are becoming the default governance pattern for GenAI, not an edge case. The article reflects a broader shift in AI security: teams are moving away from blank-slate configuration because the combinatorial policy surface is too large to tune safely from scratch. That does not remove judgement from the process, it concentrates judgement into the starting policy itself. For practitioners, the question is no longer whether policy exists, but who is accountable for the defaults that shape every later decision.
A few things that frame the scale:
- Generative AI use specifically increased from 33% in 2023 to 79% in 2025, according to McKinsey’s Global Surveys on the State of AI.
A question worth separating out:
Q: How do security teams move from observation to enforcement in GenAI governance?
A: They should start with logging-only mode, identify repeated patterns, then move to lenient blocking before tightening thresholds or adding custom guardrails. That sequence reduces the chance of breaking useful workflows while still creating a path to meaningful enforcement. The progression should follow evidence, not enthusiasm.
👉 Read our full editorial: GenAI policy management is shifting from blank slates to opinionated controls