Applies toOrganisations using hosted LLM services (Azure OpenAI / Foundry, Bedrock, Microsoft 365 Copilot, public chat tools) and self-hosted models; works with existing data classification schemes
Map classification to endpoints
| Data class | Examples | Allowed model endpoints | Conditions |
|---|---|---|---|
| Public | Published docs, marketing | Any approved tool | None |
| Internal | Internal wikis, non-sensitive tickets | Enterprise-contracted services in approved regions | Company accounts only; no consumer tools |
| Confidential | Customer data, contracts, source code | Enterprise services with data protection terms, private networking | Logging limits, PII redaction, approved apps only |
| Restricted | Regulated personal data, health/financial records, secrets | Specific approved deployments (e.g. in-region, self-hosted) or none | Risk assessment and sign-off per use case |
Fill in with your legal, privacy and security teams; contracts and regional data processing terms matter.
Questions to answer per endpoint
- Is prompt/response data used to train provider models? (Check enterprise terms.)
- Where is data processed and stored (region, data zone, global routing)?
- Is abuse-monitoring storage or human review applied, and can it be adjusted for your use?
- What logs do we keep ourselves, and for how long?
- Which identities can call it?
Enforce technically
| Control | Example |
|---|---|
| Block consumer AI tools for company identities | Web filtering / CASB, conditional access |
| Approved apps only for confidential data | Gateway with app registration and identity |
| PII/secret detection before the model | Redaction or blocking at the gateway (see the Presidio post) |
| DLP labels honoured | Sensitivity labels restrict what copilots can access/summarise |
| Region pinning | Deploy only in approved regions/data zones |
Make it easy to follow
- One-page guide with examples ("Can I paste a customer email? Only into tool X").
- Approved tool list kept current on the intranet.
- A quick path to request a new tool or use case.
Review triggers
- New provider, model or region.
- Contract or terms changes.
- New regulation or internal policy.
- Incidents (see the secrets in prompts Sev1 post).
Warning
A policy that only says "don't put confidential data into AI" is ignored. Give people an approved option for confidential work, or they will use unapproved ones.
Checklist
- Classification mapped to endpoints and conditions
- Provider terms and regions checked per endpoint
- Consumer tools controlled
- Gateway, redaction and DLP controls in place
- One-page guidance published
- Review triggers defined