Three templates for getting AI under control
Most security teams we speak to have an approved-tools list that covers a fraction of the AI actually in use. These are the three working documents we see make the biggest difference in the first month. Copy them, change them, use them.
AI system inventory
You cannot set rules for AI you have not found. One row per system, feature or agent. Most teams fill the first version in a week and find far more than they expected, mostly AI features switched on inside software they already pay for.
| Column | What goes in it |
|---|---|
| System or feature | The name people use, e.g. "assistant in the email client" or "invoice-matching agent". |
| Type | Bought tool, AI feature inside a SaaS product you already use, internal build, or agent. |
| Vendor | Who supplies the model or the feature. |
| Business owner | One named person who can answer for it. A team name is not an owner. |
| Purpose | What it is used for, in one line. |
| Data it can see | Your data classes: public, internal, confidential, personal, special category. |
| Who can use it | All staff, one department, named users. |
| Acts as | Its own identity, a shared service account, or the login of the person using it. |
| What it can do | Read only, or write, send, delete, pay, deploy. List the actions. |
| Vendor trains on our data | Yes, no, or unknown. Unknown is an answer worth chasing. |
| Risk level | Your own scale. Anything that acts on its own or sees personal data starts high. |
| Approved by and date | Who said yes, and when. |
| Next review | A date. Six months is a common default; sooner for agents. |
Where to look in the first week
- Export the app list from your SSO or identity provider and mark every tool that is AI or has AI features.
- Open the admin console of your five biggest SaaS products and check which AI features are switched on. Most arrived by update.
- Ask finance for card and expense lines that mention AI, GPT, Copilot, assistant or agent over the last six months.
- Ask each department head two questions: which AI tools does your team use, and which of them can send, change or delete something?
- Check your service accounts and API keys for anything created for an assistant, bot or automation.
Permissions checklist for AI agents
An agent that can send, change or pay is a new kind of user. Most run today on a shared service account or on the login of whoever set them up, which means nobody can say what they are allowed to do. Go through this list for each agent in your inventory.
- Each agent has its own identity. It does not run on a person's login or a shared service account.
- The agent's permissions are written down and match its job. Read, write, send, delete and pay are listed separately.
- Credentials are short-lived and rotate on their own. No long-lived keys in config files.
- Actions that cannot be undone (payments, deletions, outbound email to customers, production changes) need a person to approve them.
- Every action is logged with the agent's identity, the input that triggered it and the result.
- A named person can stop the agent at any hour, and stopping it revokes its access. You have tested this.
- Content the agent reads (email, web pages, tickets, documents) is treated as untrusted input. You have tested it with instructions hidden in that content.
- The tools and connectors the agent can call are on an allow-list. New ones need approval.
- Data the agent can reach is limited to what the task needs. It cannot browse the whole file share.
- The agent's owner reviews its permissions and logs on a schedule, at least quarterly.
- Changes to the agent's prompt, model or tools go through the same change process as code.
- It is in the AI inventory, with an owner and a review date.
Questions for your SaaS vendors about AI
Much of the AI in a company arrives as a new feature in software that was approved years ago. These ten questions get the answers you need for the inventory, and the email below is ready to send.
- Which AI features are in the product we use today, and which are switched on by default?
- Can an administrator switch each AI feature off, per user group?
- Is our data, including prompts and outputs, used to train or improve any model? Where is that written in our contract?
- Which model providers process our data, and in which regions?
- How long are prompts, outputs and logs kept, and can we delete them?
- Does the AI feature respect the same access rights as the user? Can it show a user content they could not open themselves?
- Can the feature take actions (send, change, delete) or only suggest them?
- What logs can we export showing who used the AI features and what they did?
- How do you test the feature against prompt injection and data leakage, and can you share the results?
- How will you tell us before new AI features are added or switched on?
Email to send
Subject: AI features in [product]: a few questions from our security team Hello [name], We are updating our register of AI in use across the company, and [product] is on it. Could you answer the questions below, or point us to where they are answered? 1. Which AI features are in our plan today, and which are on by default? 2. Can an administrator switch each one off, per user group? 3. Is our data, including prompts and outputs, used to train or improve any model? 4. Which model providers process our data, and in which regions? 5. How long are prompts, outputs and logs kept, and can we delete them? 6. Does the AI respect each user's existing access rights? 7. Can it take actions, or only suggest them? 8. What usage logs can we export? 9. How do you test it against prompt injection and data leakage? 10. How will you tell us before new AI features are switched on? A reply by [date] would help us complete our review. Kind regards, [name]
Want to know where you stand once the inventory is done?
Our free assessment asks the questions an auditor or a customer's security team will ask, and gives you a short report with the gaps that matter most and what to do first. It maps your answers to the EU AI Act, NIST AI RMF, the OWASP Top 10 for LLM Applications and MITRE ATLAS, so you do not have to.
Free to use and adapt inside your organisation. These templates are practical starting points and are not legal advice.