GuideNetwork · 6 min
How do we give employees safe access to AI tools?
Route AI use through the same security stack as everything else, decide what data may go into a prompt, and log it. The network enforces your AI policy.
The Clectiv team ·
An AI policy only works if something enforces it. The network is where people reach AI tools, so it's where the rules can apply. Decide what may go into a prompt, then make the security stack enforce it and keep a record.
What can the network see and stop?#
If AI traffic passes through your security stack, the stack can apply rules to it. The security stack is the filtering, app controls and data rules that every user's traffic goes through. Three controls matter for AI.
| Control | What it does | What to ask |
|---|---|---|
| Web and app filtering | Allows or blocks each AI app by name | Can it tell AI apps apart from other sites? |
| Data-loss rules (DLP) | Spots sensitive data in a prompt or upload, and stops it or warns the person | Which kinds of data, and does it read encrypted traffic? |
| Logging | Records who used which AI app, and when | How long are logs kept, and who can read them? |
The network only sees traffic that goes through it. A laptop outside the stack is invisible to it, and so is a personal phone on mobile data. Close that gap before you trust any rule.
Several providers cover it. Zscaler, Cloudflare, Palo Alto Networks and Cato Networks list web filtering, data-loss prevention and cloud app controls (CASB, which governs the cloud apps your people use). Cato Networks also lists shadow AI discovery, which finds the AI tools staff use without IT's approval.
Those names are a sample of our network providers, and Clectiv AI runs the process with them for you: start a project.
Before you call anyone#
Give Clectiv AI your AI policy as it stands, gaps included, before any security vendor gets a demo. Next, Clectiv AI runs the process: it bids the job out to the providers that fit, they compete on the same plan, and you choose. Call one first and the rules you get are the ones its product enforces.
Block AI, or allow it with rules?#
You have three options, and you can mix them app by app and team by team. The plan decides the mix, from your data and your people.
- Block. The app doesn't load. A block only covers traffic you control, so a personal phone still gets through.
- Allow with rules. Approved apps open, data rules check each prompt, and everything's logged.
- Offer an approved tool. The company provides the AI, so people have somewhere safe to go.
Liminal sells a different route. People reach AI through its own layer, which strips personal, health and card data from a prompt before it leaves, and keeps an audit log. That's who we work with in network, and Clectiv AI runs the process for you, start to finish: start a project.
This is familiar ground for us. Clectiv AI runs the process we've run many times, so you start where other companies finished. Taking the plan straight to these providers is how you get the best pricing, terms and contract we can.
Start with the data, not the apps. What may never go into a prompt? Think customer records, source code, health data and unreleased financials.
Sort it all into "never", "with rules" and "fine" with Clectiv AI, and the block-or-allow call gets much easier.
Teams differ. Legal and finance may need tighter rules than support or marketing. One rule for everyone is simple, and it'll be wrong for someone.
How does this fit our AI policy and gateway?#
Your policy writes the rules, and the network enforces them. If nothing's written, write it first. The network can only enforce what you've decided.
An AI gateway is the other piece: one managed door to the AI models, for your approved tools and your own apps, with your keys, limits and logs. Cloudflare lists an AI gateway among its products. These are network providers we bring to the table, and Clectiv AI runs the process with them for you: start a project.
The network controls what can reach the outside. The gateway controls what happens at the door.
You want both, and they should agree. A network rule that blocks the app your own gateway serves is a rule that breaks your own tool. Check them against each other before you roll anything out.
Common questions#
Can our network see which AI tools people use?#
Is blocking AI apps on the network enough?#
What's data-loss prevention for AI prompts?#
How do we log which AI tools our people use?#
Does the network replace an AI policy?#
How does Clectiv AI get this done?#
Take it to Clectiv AI. Tell it which AI tools your people use or want, and what data must never go into one. It scopes the rules with you and writes your plan: who reaches what, which data rules apply, and what gets logged.
Then the Clectiv team takes your plan to the security and network providers that fit, all at once, through our partner network of 620+ providers. Their bids land in one view, they compete for the work, the team pushes on terms, and you choose.
Other companies already made this move. Clectiv AI runs the process we've used with them, so you start where they finished. The best pricing, terms and contract we can get come from the plan going straight to the providers that fit.
You pay nothing: it's free to you, and it's days, not months. For all of network, see the network page.
Giving AI agents access too? Read how to secure AI agents.
Sources and method. No prices appear in this guide. Provider names are examples of who sells these controls, from Clectiv's provider directory and each provider's own product list, not a ranking.