Signed in asM. HalloranCompliance officer · Compliance/BSAThe console in full: every actor, every event, the adjudication queue, and the actions on the pending policy proposal.
Tools · one registry, one lifecycle
Discovered → assessed → sanctioned, restricted or blocked
Shadow-AI discovery and the allow-list are the same object at different stages. A tool enters the registry the first time it appears in the traffic and leaves the first stage only when somebody assesses it — which is the step the severity chips prove exists, and the step DeepSeek is still waiting on.Discovered1
DeepSeekpublic · 9 interactionsUNRATEDSeen in the traffic. Counted, and nothing more has been decided about it.Assessed5
ChatGPT (personal)public · 1,204 interactionsHIGHClaude.ai (personal)public · 687 interactionsHIGHGemini Advancedpublic · 412 interactionsHIGHMicrosoft Copilot (consumer)public · 238 interactionsMEDPerplexitypublic · 91 interactionsMEDSomebody rated it. The severity chip is that assessment, and it has a date.Sanctioned2
AIOS Assistantinternal · 512 interactionsnot rated — approved, not discoveredM365 Copilotenterprise · 640 interactionsnot rated — approved, not discoveredApproved as a destination — with per-class allow rules, because sanctioned is not unrestricted.Restricted1
Grok (personal)public · 12 interactionsHIGHAssessed and refused at the allow-list. The interactions that remain are attempts.Blocked0
Nothing hereEmpty, honestly: a ten-week pilot that had already banned a tool outright would read as staged.The live items
One tool at the first stage, one refused at the last
RiskDeepSeek is in use and has never been assessed
Discovered in week 10 and not yet assessed — the lifecycle with a live item at its first stage.
DiscoveredWeek 10Users3Interactions9Severityunrated — the assessment has not been performedAdverseGrok (personal) was assessed HIGH and restricted in Week 6
Assessed HIGH and restricted at the week-6 review. Its allow-list refuses every class, transformed or not; the dozen interactions that remain carried nothing sensitive, and sit below the ranking’s five.
AssessedWeek 6Interactions since12Users2The two denominators
3,805 interactions, 1,144 of them carrying a data class
Discovery counts every interaction; detection counts the subset. The columns below are never added together and never divided into one another except in the one column that says it is doing so. Trailing 30 days.| AI tool | Kind | Lifecycle | Severity | Discovered | Assessed | Users | Interactions | Detections | Sensitive share |
|---|---|---|---|---|---|---|---|---|---|
| ChatGPT (personal) | public | assessed | HIGH | Week 1 | Week 2 | 25 | 1,204 | 496 | 41.2% |
| Claude.ai (personal) | public | assessed | HIGH | Week 1 | Week 2 | 25 | 687 | 245 | 35.7% |
| Gemini Advanced | public | assessed | HIGH | Week 1 | Week 3 | 25 | 412 | 164 | 39.8% |
| Microsoft Copilot (consumer) | public | assessed | MED | Week 1 | Week 3 | 25 | 238 | 122 | 51.3% |
| Perplexity | public | assessed | MED | Week 2 | Week 4 | 25 | 91 | 44 | 48.4% |
| Grok (personal) | public | restricted | HIGH | Week 3 | Week 6 | 2 | 12 | 0 | 0% |
| DeepSeek | public | discovered | UNRATED | Week 10 | — | 3 | 9 | 0 | 0% |
| AIOS Assistant | internal | sanctioned | not rated — approved, not discovered | Week 1 | Week 1 | 25 | 512 | 0 | 0% |
| M365 Copilot | enterprise | sanctioned | not rated — approved, not discovered | Week 1 | Week 1 | 25 | 640 | 73 | 11.4% |
The five ranked tools are the site’s own ranking, computed: see them on the Overview
The allow-list
Sanctioned is not the same as unrestricted
A sanctioned destination receives the classes the institution already keeps there and refuses the two that would defeat the point of routing anything through it. These rules are what the Moment consults when a destination refuses a prompt the policy would only have warned about.AIOS Assistant · internal · sanctioned since Week 1
The institution’s own assistant, and where the coaching redirect points.
| Data class | May reach it | Rule |
|---|---|---|
| Member PII | Allowed | Permitted — the assistant runs inside the institution’s own boundary. |
| Account Numbers | Allowed | Permitted; the coaching redirect points here for exactly this reason. |
| Loan Files | Allowed | Permitted. |
| Credit Memos | Allowed | Permitted. |
| SSN / Tax ID | Allowed | Permitted; retained under the institution’s own retention schedule. |
| Board Materials | Allowed | Permitted for Executive and Finance role groups only. |
| API Keys / Creds | Refused | Refused at every destination, transformed or not, since v4. |
| BSA / AML Material | Allowed | Permitted, and warned rather than refused — the correction the second review round asked for. 31 CFR 1020.320(e) prohibits *disclosure* of a suspicious activity report to a person not entitled to receive it; the institution’s own assistant is inside the institution, and the BSA officer drafting the filing is entitled to the material they are drafting, so using it is not a disclosure. What remains is an access-control question rather than a confidentiality one — an assistant’s prompt store is readable by whoever administers it — so the control named here is need-to-know on that store: BSA/AML prompts are retained in the compliance workspace, readable by the BSA officer and the compliance officer only, and reviewed with the department’s quarterly access recertification. Every other destination refuses this class at every rung, because every other destination is outside the institution. |
| Confidential Supervisory Information | Refused | Refused. Supervisory material does not leave the examination file. |
| Custom Terms | Allowed | Permitted. |
M365 Copilot · enterprise · sanctioned since Week 1
The enterprise tenant, allow-listed per data class — sanctioned is not the same as unrestricted.
| Data class | May reach it | Rule |
|---|---|---|
| Member PII | Allowed | Permitted; the tenant is contracted and in scope for the institution’s information security program. |
| Account Numbers | Allowed | Permitted; tokenized wherever the grid says tokenize — format preserved, value substituted. |
| Loan Files | Allowed | Permitted; the tenant is in scope for the institution’s information security program. |
| Credit Memos | Allowed | Permitted; the tenant is in scope for the institution’s information security program. |
| Board Materials | Allowed | Permitted for Executive and Finance role groups only. |
| SSN / Tax ID | Refused | Refused as typed. No business case has been recorded for a tax identifier in a chat surface; a masked one carries no identifier. |
| API Keys / Creds | Refused | Refused at every destination, transformed or not, since v4 — a secret that reached a paste buffer is already compromised. |
| BSA / AML Material | Refused | Refused, transformed or not. The tenant is contracted, and it is still a nonaffiliated third party under Regulation P — outside the institution, which is the line 31 CFR 1020.320(e) draws. A mask does not move it, because the prohibition is on disclosure rather than on the characters. |
| Confidential Supervisory Information | Refused | Refused. Supervisory material does not leave the examination file, redacted or otherwise. |
| Custom Terms | Allowed | Permitted; the institution’s own vocabulary is not customer information. |