Shadow AI

AI-service inventory and trust-status assignment.

This screen belongs to the Secure deployment operator, not an ordinary hosted customer. Hosted customers have a separate account page with their own keys and limits; policy and service settings are not exposed there. Contact the operator to change protection. In the operator console, open the route listed above; a report tenant filter does not automatically scope a global setting.

Examples use educational data. Use your own authorized tenant in real integrations. Each screenshot shows the actual frontend, with the source and educational/demo mode stated below it.

Step-by-step actions

Shadow AI → locate a service and check tenant/traffic.
After approval, change its sanction status individually or in bulk.
Reread the saved list.
For blocking, configure a tested provider_unlisted policy and verify the protected route.

Every control and its meaning

Control / parameter	Values, units and effect
Сервис, статус, риск	Inventory of observed AI services. sanctioned/unsanctioned records approval status in the registry.
Массовый выбор / Bulk selection	Changes selected records in bulk. Review selected services and tenant scope first.
Тренды / Landscape	Requests/weeks describe observed usage; absence does not prove there is no bypass traffic.
provider_unlisted	Policy condition for an unlisted provider. Registry status is not a network block outside the gateway.

Verify the result

Compare saved status and the decision of a synthetic gateway call. Account separately for routes bypassing Secure.

Errors, disabling and reverting changes

After a save error, reread the persisted status; restore previous sanction status to revert. This screen is not a complete network firewall.

**Shadow AI: discovery summary · actual staging**
2026-10-15 · Actual staging application. Synthetic client, public definitions or aggregate test-stand metrics only; not customer statistics or a benchmark. Original pixels are unmodified; personal profile and private data excluded. The provider table containing internal endpoints is outside the capture. Provider statuses were not changed.

Detailed security settings · Traffic analysis · FAQ · All application sections