You can't secure the tools you don't know about
AI arrived through expense reports and browser extensions, not through procurement. Before you can set rules, you need the list — and a way to keep it current without chasing people.
One record per tool, and it stays true
Every entry carries an owner
An ID, the person accountable, the data it touches, and the date you'll look at it again.
New tools come in through intake
Requests are screened at the door, so the list doesn't rot between audits.
Renewals arrive before the invoice
Sixty days ahead, so a subscription is a decision rather than a surprise line item.
The list, kept current
Every entry carries an ID, an owner, the data it touches, and the date you’ll look at it again. Requests for new tools come in through the same intake, so the list doesn’t rot.
The newest thing on your network has credentials
An AI agent isn’t a chatbot. It has an identity, reaches into systems, and takes actions without a person watching each one. Treat it like staff: give it a scope, check what it can reach, and test it before it goes live.
Who it runs as, and who owns it.
The systems and data it can touch.
A zero-trust checklist of what it may not do.
When it was last checked, and by whom.
Two decades directing large-scale technology portfolios, enterprise risk management and applied machine learning — which is why the control library is authored and versioned the way it is, rather than assembled from templates.
Gradient Descent LLC is an independent company. GOVERNBOX.ai is not affiliated with, endorsed by, or produced on behalf of any government agency.
Start with what's actually in use
The free scorecard takes ten minutes and tells you how big the blind spot is.
Take the free scorecard →