Shadow AI and Warn (humane enforcement)
Discover which GenAI tools were used, and choose Warn (coach + allow) or Block without becoming an AI gateway.
Shadow AI and Warn
GenGuard stays browser extension + Trustity Agent One — not an MCP gateway and not a prompt firewall. Shadow AI and Warn close the gap on visibility and humane enforcement.
Shadow AI
Open Browser Protection → Shadow AI (or GenGuard → Shadow AI).
The page aggregates:
| Surface | Signal |
|---|---|
| Browser | Visits to curated GenAI domains from the GenGuard extension (app_usage) |
| Desktop | Endpoint GenGuard Live Events on known AI / coding processes (for example ChatGPT Desktop, Cursor) |
You see tool name, browser vs desktop, volume, Warned vs Blocked counts, and last seen. This is not a 15k-tool internet catalog — it is honest discovery from GenGuard sensors you already deploy.
From any row, Set policy opens Security Policies → GenGuard focused on the right surface (browser rules or endpoint text) so you can tighten enforcement immediately.
Warn vs Block
In Security Policies → GenGuard, text and file actions support:
| Mode | User experience | Live Event |
|---|---|---|
| Warn | Banner / coaching; work continues | Warned |
| Block | Hard stop; clearer reason | Blocked |
| Block with bypass | Hard stop + optional admin code | Blocked / bypass Allowed |
Defaults stay Block / existing templates unless you explicitly choose Warn. Warn still raises a Live Event so Shadow AI and SOC views stay honest.
Requires:
- Cloud Portal with Shadow AI / Warn (current production)
- GenGuard extension 3.4.5+ for browser Warn + coaching
- Trustity Agent One 4.0.3571+ for endpoint Warn
Validate (demo path)
- Use ChatGPT in the browser and a covered desktop app (for example Cursor).
- Open Shadow AI — confirm both surfaces after real use.
- Set paste / text action to Warn → coaching banner, work continues, Live Events = Warned (filter 15 min or Warned).
- Set to Block → hard stop with clearer why.