The same security your people get, plus written instructions: the job, what to deliver, and what it must never do.
What it means
Treat an AI tool like a new employee. Before it starts, decide what it can see and what it’s kept out of, who it answers to, and how things are done here. Then it gets the same layers of protection your people do.
Write its instructions down the way you’d brief a new hire: the job, what to deliver and how, and what it must never do. Clear instructions make the work better. They don’t protect your data, which is why the limits in rule 1 still apply.
A simple example
On day one, a new hire gets their own sign in, access to only the files their job needs, and a manager they answer to. An AI tool your team starts using should get the same, plus written instructions.
Do it yourself
Include AI in each layer you already have.
- What goes in and out email filtering, web and DNS filtering, and clear rules about which services company data may go to. For AI, that also means what it can read and where it can send things.
- The device managed and updated, with endpoint detection and response (EDR), and application control so only approved software runs.
- The person and the AI strong sign in with multifactor authentication, and the least access that does the job, down to the folder.
- Recovery backups and version history, and a known time to restore.
- Monitoring someone watching the logs around the clock.
- Training people who know what’s allowed and how to check AI work.
- Instructions a written brief for each AI with its job, what to deliver, and what it must never do.
How to check
Pick one AI tool and go through the layers above. Any layer that doesn’t cover it yet is the next job.
What that misses
Each layer is a separate tool with its own setup and upkeep, so it’s easy to cover AI in some layers and miss it in others.
What we do for you
We run these layers for our clients and add your AI tools to each one. You work with a dedicated engineer who knows your whole setup, and your systems are monitored around the clock.
“What we do for you” describes work we do for our clients, and what’s included depends on your plan. Already a client? Your engineer can tell you what your plan covers.
Back to all rulesGet the full guide
Technology, managed by people.
The real McCoy: real oversight, real understanding, real answers. Start with a free AI Check.