Small and Midsize Business

Most small companies adopt AI before they adopt governance. The tools arrive through individual accounts, and nobody can say later which customer data went where. This starter gives a growing company one governed path instead. It is sized so a single owner can run it alongside everything else.

A ten person operations team has no governance function. It has one person who also owns security, and a real need to let colleagues use AI on customer and vendor work. This starter is sized for that, and it gives enough control to answer a customer questionnaire.

Injection screening opens at 0.80 and blocks a matching prompt. A user and an organization are required on every call, which makes activity attributable without a role hierarchy to maintain. Redaction masks street addresses and tax identifiers. Confidential business material is blocked instead of masked, including customer lists, pricing sheets, salary figures, board minutes, merger terms, forecasts and strategic plans.

Automated traffic detection refuses a client above 12 requests each minute, and the whole deployment is held to 200 requests each minute. Term rules block harassment, discrimination, threats and fraud instructions. The quality floor is deliberately modest at a combined 0.75, with relevance at 0.72. A weaker answer is blocked, so raise the floor as the team learns what good output looks like.

Answers come back to the colleague who asked, which suits daily self service. Capture keeps metadata only, so an investigation is possible without holding raw business prompts. The audit marker shows that a request was evaluated and stores nothing on its own. Contracts, hiring practice and spend approval remain yours to align with these settings.