Skip to content
Book a risk assessment

Guardrails.

Use AI at work without leaking what matters.

We find every AI tool and agent in use, set the rules, and fix what the assistants can see before you roll them out. Then we watch what goes in.

Price
$3,900 one-off, then $1 per user monthly
Aligned to
ISO/IEC 42001, NIST AI RMF
Status
New
Start with Groundwork Take the AI Rollout Pack
AI found in use · Northbank AdvisoryExample
  • Chat assistants14 people
  • Writing tools9 people
  • Meeting note-takers6 people
  • Browser extensions4 people
  • Coding assistants2 people
ApprovedNot approved

20 of 35 people using AI were using tools nobody had checked.

Two halves

Govern what's used. Secure how it's used.

Most AI policies stop at the first half. A rule nobody can see being broken isn't doing much.

Govern

Know what's in use, and decide.

  • Find every AI tool and agent
    Chat assistants, note-takers, browser extensions and the agents built into apps you already use.
  • An approved list and AI use policy
    What's allowed, for what, and what never goes in.
  • An AI risk register
    Aligned to ISO/IEC 42001 and the NIST AI RMF, with owners.

Secure

Make what's allowed safe to use.

  • Fix oversharing before rollout
    Assistants see whatever the user can see. We fix that first.
  • Agent and connector permissions
    What each agent can read, and what it can do on its own.
  • Catch sensitive data going in
    Client files, TFNs and passwords pasted into AI raise an alert.
Oversharing

An assistant finds every file you forgot was shared.

AI assistants search everything the user can open. Years of "share with everyone" turns into payroll answers for anyone who asks. We fix permissions before rollout, not after.

Files an average staff member's assistant could reachExample
Before18,400 files
After the fix3,100 files
  • Sites shared with everyone9,200 → 0
  • Links that never expire4,300 → 0
  • Old project sites still open1,800 → 0
Agents and connectors

Every agent gets a job description.

What it can read, what it can do without a person, and who approved it. Agents that can't answer those questions don't get access.

Agent register · Northbank AdvisoryPortal · Example
Example agent register
AgentCan readCan doDecision
Meeting note-takerCalendar and meeting audioEmails summaries to attendeesApproved
External attendees are told
Invoice assistantFinance mailboxDrafts repliesApproved
Can't send, or change bank details
Website chat agentPublic FAQs onlyAnswers visitorsApproved
No customer data
Free browser extensionEvery page you openUnknownBlocked
AI risk register

Board-ready, because boards are asking.

Each AI risk has an owner, a control and a NIST AI RMF function: Govern, Map, Measure or Manage. It lines up with ISO/IEC 42001 if you go for certification.

  • AI-01
    Client data pasted into personal AI accounts
    Approved tools, Data Fence alerts
    ManageHigh
  • AI-02
    Assistant surfaces files to the wrong people
    Oversharing fixed before rollout
    MapLow
  • AI-03
    An agent acts without a person checking
    Approval step on payments and email
    GovernMedium
  • AI-04
    AI output used in client advice unchecked
    Review rule in the AI use policy
    MeasureMedium
Price

From $3,900 once, then $1 per user a month.

Setup scales by size: $5,850 up to 150 people, $7,800 up to 300, $9,750 up to 500. Finding every AI tool in use needs Microsoft E5 Security. Without it we start from browser and network data, and staff answers.

Works well withAI Rollout PackData FencePolicy Kit

Find out which AI tools your staff already use.

Groundwork asks. Guardrails finds the rest, and fixes what the assistants can see.

Book Groundwork