Skip to content
redactsure
Book a demo

Explore.

Data Report · By Chris Sowa · Published
Last updated

What Controls Are You Actually Putting in Place to Stop Employees From Feeding Sensitive Data to Public AI?

Working controls sit at five points: the destination, the content, the account, the data itself, and the workflow. Each point stops something the others miss, and none holds alone. An organization that relies on one of them, usually blocking, moves the activity onto routes it cannot observe and finds the gap during an incident instead of in the design.

Documents cross a series of controls that divert sensitive records before cloud submission.

Working controls sit at five points: the destination, the content, the account, the data itself, and the workflow. Each point stops something the others miss, and none holds alone. An organization that relies on one of them, usually blocking, moves the activity onto routes it cannot observe and finds the gap during an incident instead of in the design. The controls that practitioners actually deploy operate at those five points: the destination, where access to public AI services is allowed, warned, or blocked; the content, where data loss prevention inspects what is pasted, typed, or uploaded; the identity and account, where enterprise accounts replace personal ones; the data itself, where classification and minimization reduce what is available to share; and the workflow, where a governed route keeps sensitive values out of the model entirely through render-layer tokenization. No single point is sufficient, and each has documented limits. Each control point stops something, misses something, and is combined with the others in a working program. The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.

Key findings

  • Microsoft documents endpoint data loss prevention policies that can warn or block users from sharing sensitive information with third party generative AI sites accessed through a browser (Microsoft, 2025).
  • OWASP ranks sensitive information disclosure second in its 2025 Top 10 for LLM Applications, covering personal data, credentials, and proprietary information (OWASP, 2025).
  • The NCSC warns that information entered into consumer AI services may be stored, retained, or used to improve the service outside corporate governance, unless specific privacy controls are in place (NCSC, 2026).
  • IBM reported that 97 percent of organizations that experienced an AI related breach lacked proper AI access controls, which indicates that access control, not awareness alone, is the recurring gap (IBM, 2025).
  • Salesforce's survey found 55 percent of employees had used AI tools their employer had not sanctioned, so controls must assume use is already happening (Salesforce, 2024).
  • Joint CISA and NSA guidance on AI data security recommends protecting data across its supply chain and lifecycle, including encryption, provenance, and secure storage (CISA, 2025).

Which control points exist between an employee and a public AI service?

It is useful to picture a single event. An employee copies a customer record, opens a public AI service, pastes the record, and submits it. Controls can intervene before the copy, at the browser, at the network, at the service, or after the event in a log. Each intervention point has a different owner, a different cost, and a different failure mode, which is why control design starts with the event rather than with a product category.

Controls also differ in what they can see. Network controls see destinations and volumes. Endpoint controls can see the application, the file, and in some configurations the pasted content. Browser controls can see page level activity inside a session. Identity controls see who signed in and what they authorized. Data controls travel with a document in the form of a label or encryption. A program that deploys only one of these views will have a corresponding blind spot, and it is better to name that blind spot in the design than to discover it during an incident.

How do destination controls on AI sites and applications work?

Destination controls decide which AI services can be reached from managed devices and networks. They are implemented in secure web gateways, firewalls, DNS filtering, cloud access security brokers, and managed browser policies, using lists of known AI services sorted into approved, tolerated, and prohibited categories. Microsoft documents network data security collection policies that apply to unmanaged cloud apps and to categories including generative AI, using the Defender for Cloud Apps catalog of over 35,000 discoverable apps as a source of destinations (Microsoft, 2025).

Destination controls are effective at scale and simple to explain, and they are the right tool for services whose terms the organization has assessed and rejected. They also produce the discovery data that feeds an inventory, because attempted access to a prohibited service is a signal about demand.

Their weaknesses are structural. Categorization lags behind the market, so a new service may be reachable for weeks before it is classified. A domain may host both a consumer tier and an enterprise tier with different data terms, and blocking by domain cannot distinguish them. Most importantly, destination controls on the corporate network do nothing on a personal device or a home network. They should therefore be described as controls on managed access, not as a guarantee that data cannot reach a service.

What can content inspection and data loss prevention actually stop?

Content inspection examines what is being shared, rather than where it is going. Data loss prevention policies use sensitive information types, keywords, exact data matching, trainable classifiers, and sensitivity labels to recognize content such as financial account numbers, health information, national identifiers, and labeled confidential documents (Microsoft, 2025). Policies can then audit the action, display a warning, require a business justification, or block it.

Microsoft gives a concrete example in its documentation: on Windows computers onboarded to Purview, endpoint DLP policies can be configured so that a user is prevented from pasting credit card numbers into a public chatbot, or is shown a warning that they can override (Microsoft, 2025). Microsoft also documents browser based controls for text pasted or uploaded into third party AI applications, and network data security policies covering text and files sent to or received from cloud and AI apps (Microsoft, 2025). These are the controls most directly aimed at the paste itself.

Content inspection has real limits. Pattern based detection recognizes formats, so it is strong on card numbers and identifiers and weaker on unstructured confidential material such as a pricing strategy, a negotiation position, or a paragraph from an unreleased report. Paraphrase, screenshots, photographs of a screen, and manual retyping all bypass paste inspection. Inspection can also generate false positives that interrupt legitimate work, which is why Microsoft supports testing policies in simulation before enforcement, and why teams tune policies by data type and destination rather than enabling every rule at once.

There is a further limit specific to AI. Inspection decides whether content may be sent, based on what the content looks like. It does not change what a model does with content that is permitted, and it does not govern what an AI agent does later with data it was legitimately given. OWASP's treatment of sensitive information disclosure covers both the input side and the disclosure of data through model responses, which is a reminder that controlling the paste is only half of the exposure (OWASP, 2025).

Why do account and identity controls change the risk, not just the login?

Moving staff from personal accounts to enterprise accounts changes the legal and technical position, not merely the sign in screen. Under an enterprise agreement, the organization can typically set retention, restrict training use of inputs, administer access, require single sign on and multifactor authentication, obtain audit logs, and request deletion. Under a personal account, it can do none of those things. The NCSC makes the underlying point: data transferred to consumer services leaves the organization's visibility and control, and may be retained or used to improve the service outside established governance arrangements (NCSC, 2026).

Identity controls also cover the connections an account creates. Reviewing and restricting OAuth grants, limiting which third party applications can connect to mail and file systems, and requiring administrator approval for high scope grants all reduce the chance that an AI tool gains standing access to a data store. NIST's zero trust architecture supports this direction: access to a resource is granted per session, with least privilege, and is determined by dynamic policy rather than by network location (NIST, 2020).

Account controls have their own gap. Single sign on coverage ends where personal accounts begin, and a determined or merely hurried employee can still open a personal account in a private browser window. That is why identity controls are normally paired with endpoint and browser controls on managed devices, and with a policy position for unmanaged devices that is honest about what the organization cannot observe.

How do classification, minimization, and training reduce what gets shared?

Controls that act before any AI tool is involved reduce the amount of sensitive material available to be shared in the first place. Data classification and labeling identify which repositories hold customer personal data, regulated records, and trade secrets, and they allow stricter rules to be applied to those locations. Retention reduction matters as well: data that has been deleted on schedule cannot be pasted into anything.

Minimization is the same principle applied to a task. Joint guidance from CISA, the NSA, the FBI, and partner agencies on securing the data used to train and operate AI systems emphasizes data provenance, integrity, secure storage, and encryption across the data lifecycle (CISA, 2025). NIST's Generative AI Profile lists data privacy among the risks specific to generative AI, including leakage and de anonymization of sensitive data (NIST, 2024). Both sources point toward giving any AI system, internal or external, only the data its task requires.

Training is often treated as the primary control, and it is better understood as a supporting one. Staff need to know which data categories may never be entered into a public service, what an enterprise account changes, and how to obtain the same result safely, for example by summarizing a document with names and identifiers removed, or by using an approved internal tool. Training that consists only of prohibitions tends to be forgotten at the moment of time pressure, which is the moment the paste happens. Task based guidance, short examples, and a named contact for questions are more durable, and their effect can be observed in falling override and alert rates.

What are the limits of blocking, and what should be measured instead?

Blocking has a legitimate place, and it also has a documented failure pattern. If the approved route is slower, less capable, or unavailable, blocking a public service transfers the activity rather than ending it. The NCSC advises organizations not to rely on prohibition, and to provide approved alternatives that meet real business needs, alongside a positive culture in which staff raise questions openly (NCSC, 2026). Salesforce's finding that a majority of surveyed employees had used unsanctioned tools indicates the scale of demand that blocking must contend with (Salesforce, 2024).

Measurement should therefore focus on exposure, not only on attempts. Practical measures include the number of confirmed events in which regulated data reached an unmanaged destination, the proportion of AI use occurring through enterprise accounts, the override rate on warnings and the reasons recorded, the time taken to decide new tool requests, and the number of repositories containing sensitive data that have no owner or label. These measures can be reviewed against the NIST AI Risk Management Framework, in which Measure and Manage are continuing functions rather than a project with an end date (NIST, 2023).

Where does RedactSure sit?

The fifth control point, the workflow, is where RedactSure sits. The first four decide whether a paste may happen; the governed route removes the reason to paste. Supervised AI co-workers complete browser workflows across an organization's existing applications inside a governed environment, with no per-application integration and no change to user permissions. Every value chosen by policy, starting with names, account numbers, national identifiers and dates of birth, is replaced by a consistent token at the render layer before any model reads the screen, so the model works from ACCT_001 and SSN_001 instead of the customer record an employee might otherwise paste into a public service. Real values resolve only at approved destinations at the moment of an approved action.

The Planner sets which values are tokenized and what the agent may do on each screen, and a named person confirms that policy before the run and approves every payment, submission and record change while it runs, which is Supervised Delegation. Customer-held keys protect the stored ciphertext, and the AI Control Record shows what the model actually received, screen by screen, exported to the customer's own SIEM. The environment is model agnostic, and deployments are in pilot. Everyone else controls where data can go. RedactSure controls what the AI can see.

Methodology and limitations

The page rests on vendor and standards documentation and published research, read as of October 13, 2026: Microsoft Learn documentation on Purview data loss prevention, endpoint DLP, and network data security (vendor documentation); OWASP's Top 10 for LLM Applications 2025, LLM02 Sensitive Information Disclosure (industry standard); NCSC guidance on the hidden risks of shadow AI, published September 2026 (official guidance); NIST SP 800-207 Zero Trust Architecture, the NIST AI Risk Management Framework 1.0 and the NIST Generative AI Profile, NIST AI 600-1 (official guidance); joint CISA and NSA guidance on AI data security (official guidance); IBM's Cost of a Data Breach Report 2025 and Salesforce's AI at work survey (industry analysis). Figures are quoted as the publisher states them.

No control was tested, and no product's detection accuracy, false positive rate, or coverage was measured. Statements about what a control can do reflect the publisher's documentation for the configuration described, and actual behavior depends on licensing, device onboarding, browser, and policy settings, which readers must verify in their own environment. Vendor features change, and Microsoft in particular revises its Purview documentation often; the page carries its date and is revised when the documentation changes. The employee, the customer record and the paste describe an event type, not any organization; no customer or prospect is described, and control effectiveness in any specific organization cannot be inferred from the page.

Whether a given set of controls meets an organization's legal, contractual or regulatory obligations is a determination for its counsel, its assessor, and its own security and compliance officers, not for this page.

What the record shows

The controls practitioners actually use form a chain: destination rules decide which services may be reached, content inspection examines pasted or uploaded material, enterprise accounts bring use under organizational terms, and classification shrinks what there is to share. Each layer has a documented failure mode the next partly covers, and none survives alone against staff trying to finish a task. The strongest link is the governed workflow route that keeps sensitive values out of the model altogether, because it removes the reason to paste rather than policing the paste. The test for any program is one question: for each route an employee could take to a public AI service, which control point sees it, and what reaches the model when it does? A program that cannot answer for personal devices and private browser windows has a blind spot it should name now rather than discover later.

Frequently asked questions

Can data loss prevention stop all sensitive data reaching public AI?

No, and expecting it to is the common design error. Content inspection works on what passes a managed point in a recognizable form; it is weaker against retyped summaries, screenshots, personal devices, and accounts outside the managed estate, and it finds data in motion rather than deciding whether a tool should be used at all. Inspection is one of five control points for that reason. Its alerts are most useful as evidence about which rules and alternatives are failing.

Why do enterprise accounts change the risk rather than just the login?

Because the account decides whose terms govern the data. The NCSC warns that information entered into consumer AI services may be stored, retained, or used to improve the service outside corporate governance, unless specific privacy controls are in place. An enterprise account brings the same tool inside contractual and administrative controls the organization can inspect and configure. Staff keep the capability they wanted, while the data they enter stays under the organization's retention and access rules.

Is blocking public AI websites enough on its own?

No. Blocking closes one destination class on managed networks and browsers, and the survey evidence shows use is already widespread, including on routes a network block does not reach. Blocking also says nothing about what staff paste into approved tools with new AI features. It has a place inside destination control, but organizations with working programs pair it with inspection, managed accounts, classification, and a governed alternative, then measure what still gets through.

Can training replace the technical controls?

No. Training is a supporting control. Prohibition-only training is forgotten under time pressure, which is when the paste happens. Task based guidance that shows staff how to get the same result safely, such as summarizing a document with identifiers removed or using an approved internal tool, lasts longer, and its effect shows up in falling override and alert rates. IBM's finding that 97 percent of AI related breaches involved missing access controls points to controls, not awareness, as the recurring gap.

What should an organization measure to know whether the controls work?

Exposure, not attempts. Useful measures are the number of confirmed events in which regulated data reached an unmanaged destination, the share of AI use that runs through enterprise accounts, the override rate on warnings and the reasons given, the time taken to decide a new tool request, and the count of sensitive repositories with no owner or label. Reviewed on a schedule, these follow the Measure and Manage functions of the NIST AI Risk Management Framework.

Does a governed workflow replace DLP and blocking?

No, it closes the gap they leave. DLP and blocking act on a paste that is about to happen. A governed workflow replaces identifiers with tokens at the render layer before any model reads the screen, so the task is completed without the record ever being in a position to be pasted, and a named person approves every consequential action. Destination, content, account and data controls still cover the routes outside that workflow.

Book an AI Agent Security Review →

Bring your hardest questions.

Bring one sensitive workflow and the decisions your team needs to keep in its hands.

Book a demo

About the author

Christopher Sowa
Chris SowaCo-Founder, President and Chief Commercial Officer, RedactSure

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

Book a demo

Book a demo

Having trouble? Open the booking page or email us.