Notifications
Clear all
Topic starter
17/08/2026 4:36 pm
TL;DR: AI acceptable use policies now have to govern employees, contractors, and AI agents, because shadow AI, unsafe data sharing, and unreviewed outputs create visibility gaps that written rules alone cannot close, according to WitnessAI. The governing problem is not policy absence but policy enforcement, auditability, and accountability across runtime AI interactions.
NHIMG editorial — based on content published by WitnessAI: a practical guide to AI acceptable use policy design and runtime enforcement
By the numbers:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
- 96% of technology professionals identify AI agents as a growing security threat, and 66% believe this risk is immediate.
Questions worth separating out
Q: How should security teams enforce AI acceptable use policies at runtime?
A: Security teams should pair the written policy with discovery, intent-based controls, and audit logging.
Q: Why do AI agents change acceptable use policy design?
A: AI agents change the policy model because they can take actions, call APIs, and use credentials without waiting for a human to click every step.
Q: What breaks when shadow AI is not discovered early?
A: Teams lose sight of which agents exist, what they can reach, and which credentials they use.
Practitioner guidance
- Define policy scope by identity type Explicitly cover employees, contractors, and AI agents, then assign a named owner for each class so accountability is not ambiguous during incidents or reviews.
- Classify data before AI access is allowed Map public, internal, and restricted data to specific approved tools and require written approval for sensitive categories such as credentials, payment data, or PHI.
- Bind agents to scoped identities and owners Give every agent a verified identity, limit permissions to task scope, and keep a human sponsor responsible for its actions and revocation path.
What's in the full article
WitnessAI's full article covers the operational detail this post intentionally leaves for the source:
- Specific policy language for scope, ownership, approved tools, prohibited uses, and review cadence.
- Runtime enforcement mechanics for allow, warn, block, and route actions across AI interactions.
- Audit trail examples that tie each interaction to the user, agent, tool, and rule.
- Guidance on AI agent and MCP governance inside an acceptable use programme.
👉 Read WitnessAI's full guide to AI acceptable use policy design and runtime enforcement →
AI acceptable use policy gaps: how should teams enforce them?
Explore further
17/08/2026 4:43 pm
Shadow AI is a governance problem before it is a technology problem. The article’s central risk is not simply that employees use unapproved tools, but that usage moves outside the security team’s line of sight. Once that happens, the organisation loses policy enforcement, evidentiary trails, and control over where sensitive data travels. For identity teams, this is the same governance failure pattern seen when sanctioned access and actual access diverge. The practitioner conclusion is that discovery and approval must precede enforcement, not follow it.
A question worth separating out:
Q: Who is accountable when an AI system makes a harmful decision?
A: Accountability should follow the identity chain that authorized, configured, or triggered the action, including the human owner, the platform team, and any delegated agent or tool account. If the organisation cannot name that chain, the governance model is too weak for regulated AI use.
👉 Read our full editorial: AI acceptable use policies are falling short without runtime control
