ABDULLAH AL OWASIShadow AI & acceptable use / Source records · review logic · decision outputs
Shadow AI & acceptable use.
Unapproved AI use triage register. Contain unapproved use and assign an owner.
Evidence-led domain review
Review the scope. Surface the gaps.
Enter the domain-specific decision inputs, authorized evidence metadata and review checks. Findings update immediately; an accountable reviewer makes the final decision.
Structured review JSON
Checks record your assertions. Evidence content is not fetched or verified; this review does not confer compliance or authorization. This form is in memory and does not upload its inputs.
Decision scope
Prepare a unapproved ai use triage register for the agreed population and human decision.
Review capabilities
- Unapproved AI tools identified
- Approved temporary exception allowance
- Discovery population reviewed
Decision outputs
- Unapproved AI use triage register
- Domain-specific calculations and exception actions
- Linked evidence, ownership and review dependencies
Framework anchors
NIST AI RMF · ISO/IEC 27001 Annex A
Confirm jurisdiction, applicability, evidence scope and reporting period before assessing conformity.
Upstream dependencies
Downstream impacts
Working review and evidence
Use the dedicated domain perspective to maintain ai records. Record domain ownership, link control tests and evidence, and review the resulting dependencies. Shared record references retain relationships across domains.
Open Shadow AI & acceptable use workspace →Public tools recalculate locally. External telemetry collection requires authorized production integration.
From portfolio logic to a bounded review.
Adapt this pattern
Bring the real decision boundary, authorized metadata, evidence available, accountable reviewers and target date. The workflow can then be scoped around explicit outputs and acceptance criteria.
Use the linked source records and assessment dates to review the scenario basis.