> For the complete documentation index, see [llms.txt](https://docs.ox.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ox.security/ox-policies/cloud-ai-governance-policies.md).

# Cloud AI Governance Policies

Cloud AI Governance policies provide visibility into how AI is used in production cloud workloads. The OX Runtime Sensor observes workload activity at the kernel level to identify the AI providers, models, and external AI services that applications communicate with.

These policies help detect unsanctioned AI usage, abnormal activity, excessive permissions, sensitive data exposure, and risks associated with Retrieval-Augmented Generation (RAG) data sources.

The article describes the policies in this category, their configuration options, and the impact of policy violations. For an overview of policies and policy management, see the Policies article.

Open each policy to view its business impact and optional settings.

The structure below follows the purpose, business impact, and settings format used in the existing policy documentation.

<details>

<summary>Shadow AI services</summary>

**Purpose:** Detect workloads that communicate with AI services that are not explicitly approved by the organization.

**Business impact:** Unsanctioned AI services can send sensitive organizational data to unapproved third parties. They can also introduce privacy, compliance, supply-chain, and data residency risks when security teams do not know which providers are being used.

Use the provider list to specify which AI services are considered unapproved. OX reports an issue when a workload communicates with one of the selected providers.

| Setting         | Description                                                            | Default         |
| --------------- | ---------------------------------------------------------------------- | --------------- |
| ON/OFF (toggle) | Enable or disable the policy.                                          | OFF             |
| Severity        | Set the severity assigned to issues detected by the policy.            | High            |
| AI providers    | Select the AI providers that OX should identify as shadow AI services. | Current setting |
| Add provider    | Add another AI provider and the domain pattern used to identify it.    | Current setting |

</details>

<details>

<summary>Abnormal usage of AI services</summary>

**Purpose:** Detect workloads that make an unusually high number of calls to an AI service.

**Business impact:** A sudden increase in AI service usage can indicate a compromised agent, an unintended execution loop, or unauthorized data transfer. Excessive requests can also generate significant and unexpected usage costs.

OX compares the workload’s daily call volume with its typical activity. The policy reports an issue when both the configured daily call limit and spike multiplier are exceeded. The policy reports activity but does not block traffic.

| Setting              | Description                                                                                 | Default |
| -------------------- | ------------------------------------------------------------------------------------------- | ------- |
| ON/OFF (toggle)      | Enable or disable the policy.                                                               | OFF     |
| Severity             | Set the severity assigned to issues detected by the policy.                                 | High    |
| Max AI calls per day | Set the maximum number of AI service calls that a workload can make in one day.             | 100     |
| Spike multiplier     | Set the increase relative to the workload’s typical daily usage that OX considers abnormal. | 3       |

</details>

<details>

<summary>AI Privileged Container</summary>

**Purpose:** Detect AI agent containers that run with the privileged flag enabled.

**Business impact:** A privileged AI container has extensive access to the host and can escape the container boundary. If the agent or one of its tools is compromised, an attacker may gain access to host resources, mounted devices, processes, or kernel capabilities.

OX reports an issue when a workload classified as an AI agent starts with privileged access. The policy reports the exposure but does not block traffic or change the container configuration.

| Setting         | Description                                                 | Default |
| --------------- | ----------------------------------------------------------- | ------- |
| ON/OFF (toggle) | Enable or disable the policy.                               | ON      |
| Severity        | Set the severity assigned to issues detected by the policy. | High    |

</details>

<details>

<summary>AI Sensitive Data Access</summary>

**Purpose:** Detect AI agent containers that access credentials or other sensitive files.

**Business impact:** Sensitive information available to an AI agent can be exposed through model output, prompt injection, compromised tools, or unintended external requests. This can result in credential theft, unauthorized access, or disclosure of confidential data.

OX reports an issue when a workload classified as an AI agent triggers credential-access or sensitive-data detection rules, such as reading credential files or accessing sensitive environment variables. The policy reports the activity but does not block access.

| Setting         | Description                                                 | Default |
| --------------- | ----------------------------------------------------------- | ------- |
| ON/OFF (toggle) | Enable or disable the policy.                               | ON      |
| Severity        | Set the severity assigned to issues detected by the policy. | High    |

</details>

<details>

<summary>AI Data Exfiltration</summary>

**Purpose:** Detect AI-related workload activity that may transfer organizational data to an external AI service or other unauthorized destination.

**Business impact:** Data sent outside the organization can expose source code, credentials, customer information, intellectual property, or other sensitive content. The risk is greater when an AI agent has broad access to files, cloud resources, or internal services.

| Setting         | Description                                                 | Default |
| --------------- | ----------------------------------------------------------- | ------- |
| ON/OFF (toggle) | Enable or disable the policy.                               | ON      |
| Severity        | Set the severity assigned to issues detected by the policy. | High    |

> **Note:** The supplied screen does not show the expanded policy description or any additional configuration options for this policy. The exact detection conditions should be confirmed before publication.

</details>

<details>

<summary>RAG Poisoning</summary>

**Purpose:** Detect RAG corpora or backing stores that can be modified by an untrusted identity.

**Business impact:** An attacker who can modify the content retrieved by a RAG application can insert misleading information or indirect prompt-injection instructions. The AI model may then use the poisoned content in its responses, causing incorrect, unsafe, or unauthorized behavior.

OX evaluates whether the indexed document corpus, vector store, query engine, or underlying storage location is publicly writable or otherwise writable by an untrusted identity. The policy reports the exposure so that access to the ingestion source can be restricted.

| Setting         | Description                                                 | Default  |
| --------------- | ----------------------------------------------------------- | -------- |
| ON/OFF (toggle) | Enable or disable the policy.                               | ON       |
| Severity        | Set the severity assigned to issues detected by the policy. | Critical |

</details>

<details>

<summary>RAG Publicly Readable</summary>

**Purpose:** Detect storage assets used by RAG applications that can be read by unauthorized identities.

**Business impact:** Publicly readable RAG data sources can expose indexed documents, embeddings, or other information used by the AI model. Unauthorized users may retrieve confidential information or use the exposed data to better understand and target the application.

OX evaluates the indexed corpus, vector store, query engine, and associated storage configuration. The policy reports an issue when the backing store is publicly readable, such as through anonymous access, a public search endpoint, or an overly broad identity permission.

| Setting         | Description                                                 | Default  |
| --------------- | ----------------------------------------------------------- | -------- |
| ON/OFF (toggle) | Enable or disable the policy.                               | ON       |
| Severity        | Set the severity assigned to issues detected by the policy. | Critical |

</details>

## View policy issues

1. Open the Active Issues page.
2. Use the Category filter and select Cloud AI Governance.
3. Use the Policy filter to narrow the results to a specific policy.
4. Apply the Category and Policy filters separately or together, depending on how specific you want the results to be.
5. Use the search box to refine the results.

## Save policy changes

When you change a policy’s severity, ON/OFF toggle, or another setting, save the current profile or create a new profile.

* To save the current profile, click **SAVE** in the page header.
* To create a new profile, click **SAVE AS** in the page header.

For instructions, see Create or edit policy profiles in the Policies article.

## View policy issues

1. Open the Active Issues page.
2. Use the **Category** filter and select the policy category to view related active issues.
3. Use the **Policy** filter to narrow the list to a specific policy.
4. Apply the Category and Policy filters separately or together, depending on how specific you want the results to be.
5. Use the search box to refine results, such as filtering by file name, keyword, or rule identifier.

## Create or save policy profiles

When you change a policy’s severity, ON/OFF toggle or any other setting, you must save the current profile or create a new one.

* To save the current profile, click **SAVE** in the page header.
* To create a new profile, click **SAVE AS** in the page header. For instructions, see the section [Create or edit policy profiles ](https://open-2c.gitbook.com/url/preview/site_RHimt/~/revisions/esBak1HVuTgsCEeNbzHE/policies?theme=light#create-or-edit-policy-profiles)in the [Policies ](/ox-policies/policies.md)article.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.ox.security/ox-policies/cloud-ai-governance-policies.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.