Shadow AI Discovery

Every large company has more AI in use than its inventory shows. The gap turns up through an expense report, browser telemetry, a vendor invoice or a colleague who speaks up. Handling what surfaces is a governance job with an unusual property. The evidence is often more sensitive than the tool it describes.

Somebody forwards a screenshot of a chatbot summarizing customer records. That report immediately becomes one of the most sensitive items in your queue, because it names a team, a tool and a data set. Triage work of that kind is what this starter governs.

Discovery is adversarial in a way that a curated inventory is not. Nobody filed the entry, and the person who used the tool may not know a rule was broken. The controls therefore assume the finding contains material that was never meant to travel.

A pasted transcript can carry instructions aimed at the gateway itself, so injection screening runs ahead of everything else. An identity check then limits who can read a triage summary. Redaction removes national identifier patterns from the pasted evidence. A match on the word secret, a private key or an access token blocks the request outright.

Finding a tool is not the same as retiring it. Route each confirmed case into your inventory, your investigation queue and a named remediation owner. The escalation step is an empty block until you configure it, so treat human review as a decision your process makes today. Audit marking labels the evaluated request and creates no storage of its own.