DLP
The alert shows where the data went, not whether the tool was approved or who owns it.
Security ops
Block it and the work stalls, but leave it and nobody owns what it can reach.
Privacy office
You need visibility, and people need to know what is and isn’t kept about them.
How it works todayWhat it needs to be
- How it works today
One web filter category for all generative AI
What it needs to beKnowing which AI tools are at work, down to features inside apps
- How it works today
A security review once, at purchase
What it needs to beA second look whenever a vendor adds AI or changes models
- How it works today
An acceptable use policy signed at onboarding
What it needs to beRules tested quietly before they block
- How it works today
Agents running with their builder’s access
What it needs to beEach agent held to the services it’s approved to call
We already run DLP and a web gateway. What does this add?
An owner and a decision. Your DLP and gateway keep their jobs. For each AI tool discovery finds, your team adds an inventory record with an owner or raises a request, and a reviewer decides. For agents connected to Enzai, you approve the services each may call, and other calls are blocked before they run.
Will it start blocking work on its own?
No. Discovery only observes, and nothing is blocked until your team publishes a control and switches it from Observe to Enforce. Run it in Observe first to see what it would have caught. When something is blocked, people can ask for time-boxed access with a reason where the rule allows it, and your team approves or rejects it.
Does Enzai see our prompts, or who sent them?
Not by default. Prompts stay private unless you choose to share metadata, a redacted prompt or the full prompt. Discovery reports usage in aggregate, without naming people. Turning on attribution is your call and, in much of Europe, one for your workers’ representatives too.
Where do we start if we can’t see the AI in use yet?
With discovery for one team. It lists the AI tools in use, marks AI features inside other products and shows which are already on record. It works from a catalog of known services, so treat the list as a strong start. Give the ones that matter an owner, then set your first control.
Will our controls hold up, and can we prove it to auditors?
Each block is recorded with the AI system, the rule that matched and the control version in force, and blocked agent calls with the agent and environment. If Enzai can’t be reached, controls fail closed by default, so an outage never quietly switches your rules off.
Where to start
