AI Policy, Standards and Acceptable Use

Purpose: Provide practical acceptable-use rules for AI users, developers, vendors, custom AI applications and agents.

Audience: All AI users, developers, governance, compliance, HR/policy teams, security awareness.

Acceptable AI Use

AI tools may be used only when approved, governed and aligned with data classification, information protection, confidentiality, security and regulatory requirements.

Prohibited AI Use

Users must not submit or upload:

• Critical infrastructure information.
• Restricted or confidential documents unless approved controls are in place.
• Passwords, API keys, certificates, tokens or secrets.
• Customer, employee or regulated data unless explicitly approved.
• Internal architecture diagrams, network configurations or security procedures.
• Full proprietary source code or sensitive application logic unless approved.
• Procurement, legal, audit or security assessment data to unapproved AI platforms.

Public AI Platform Rules

• Use approved enterprise AI platforms where available.
• Do not use personal AI accounts for business data.
• Do not bypass browser, endpoint or DLP controls.
• Treat AI output as unverified until reviewed.

AI Coding Assistant Rules

• Do not submit production credentials or sensitive source code.
• Review AI-generated code under secure coding processes.
• Validate dependencies and generated configurations.
• Report suspicious or unsafe AI suggestions.

Agentic AI Rules

• No autonomous action without defined owner, identity, scope, tool list, approval workflow, logs and kill switch.
• Sensitive business actions must require human approval.
• Tool/API permissions must follow least privilege.