Safe corporate AI: why a chatbot is not enough

Typical scenario: a department deploys a language model, connects document uploading to it, and shows a demo. The demo works. Then a break begins: the security service asks where the prompts go; lawyers - on what basis did personal data enter the model; process owner - why the answer cannot be attached to the solution if there is no source under it. The project is stopped not because of the quality of the model, but because of the lack of a environment around it.

Enterprise AI differs from a chatbot not in the size of the model, but in the fact that each answer has traceable basis: who asked, what data he was entitled to, where the fragment came from, what was logged and who is responsible for the consequences. Everything else - manageability, cost, scaling - are consequences of this.

The controlled environment is assembled from five layers. Skipping any of them gives exactly the same risks as listed above.

1. Identification and access

The user logs into the AI ​​service through a corporate directory, and not through a separate account. His roles and groups must reach the search layer: if in the source he sees three out of ten folders, then the model responds with three. A separate task is the accounts of agents and integrations: they have their own life cycle, their own secrets and their own rotation, and the same discipline works here as in IDM/PAM and access control.

2. Gateway and policies

Between the user and the model there is a layer that applies rules: what data can be sent, what categories are prohibited, what answers require confirmation, what tools are available in this role. There are also quotas, timeouts and protection against budget exhaustion. The gateway is required for both external models and your own: it is the only point where policy can be changed centrally.

3. Models and calculations

The choice between an external API and your own loop is not a matter of ideology, but of data class. For trade secrets, personal data and code, its own perimeter is more practical: the model operates at controlled capacities, prompts do not leave the environment. This is already an infrastructure task - memory, accelerators, fault tolerance, token cost; the direction is dedicated to her AI infrastructure and computing power.

4. Data and knowledge

The layer that answers the question “where does the fact come from?” This is where source connectors, normalization, chunking, vector index, chunk-level permissions, and update rules live. Practical implementation - Enterprise RAG; testing a hypothesis on your knowledge base is the cheapest way RAG pilot.

5. Observability and responsibility

Logs, quality metrics, incident analysis and owner for each scenario. Without this layer, it is impossible to prove correctness or improve the system: there is nothing to measure against. It makes sense to include AI environment events in general information security monitoring - SIEM, SOAR, SGRC, so that AI does not remain a blind spot.

Putting these layers together is what we unfold as Restart AI Enterprise Platform and design within the framework of the solution "Secure Enterprise AI".

The main question of implementation is not “which model”, but “what data can it use”. The answer begins with the classification: open, internal, confidential, personal data, restricted information. For each category, the mode is fixed: whether it can be sent to an external service, whether depersonalization is necessary, where the index is stored, how long the logs last.

• Depersonalization and masking. A significant part of scenarios does not require real personal data: masked data is sufficient for analytics, tests and training. This is a separate engineering work - masking and depersonalization, — and it greatly expands the list of scenarios allowed without additional approvals.
• Permissions at the fragment level. The entire document may be available, but its attachment may not. If the index only stores a link to the document, the delimitation will break at the first exception.
• Freshness and origin. Each fragment must have a source, date and version. The answer based on a document that was canceled six months ago is formally correct and actually harmful.
• Source quality. The model does not create contradictions in the data, it strengthens them and makes them convincing. There is a separate article about this “Why an AI project starts with data”.

• Personal data. If there is PD in the prompts or index, the requirements of Federal Law No. 152-FZ apply: grounds for processing, localization of databases, threat model, notification of Roskomnadzor. The binding is described in the solution “Federal Law No. 152-FZ and personal data”.
• Significant CII objects. The implementation of an AI service into the environment of a significant object is a change that takes place according to the rules of Federal Law No. 187-FZ: categorization, approval, protective measures. Cm. "Protection of CII / Federal Law No. 187-FZ".
• Trade secret. CT mode requires media and access considerations. The RAG index is a storage medium and should be included in the list along with file storage.
• Industry requirements. For banks and payment infrastructure, Central Bank standards are added; for government systems - GIS requirements ("GIS protection").

It helps to reduce these requirements to control procedures and monitor their implementation. Security & Compliance AI, and gives a one-time assessment of compliance compliance practice.

Go through the points. Each “no” is not a sentence, but a specific task on the roadmap.

Access

• Login to the AI ​​service is done through the corporate directory, and not through local accounts.
• User rights are applied at the fragment search stage, and not after the fact.
• Each agent and integration has a separate account with minimal rights and rotation of secrets.

Data

• There is a classification of data and for each category the mode of use in AI is described.
• It is known where the index, caches and logs are physically located.
• For scenarios that do not require real personal data, depersonalization is used.
• Each index fragment has a source, version, and date.

Control of responses

• The answer contains references to sources, and is not a paraphrase without justification.
• The system can answer “I don’t know” and transfer the question to a person.
• Irreversible actions of an agent require human confirmation.

Observability

• The dialogue is reproducible: the context, model version and index version are saved.
• Events of the AI ​​environment fall into general information security monitoring.
• Logs have a retention period and access restrictions.

Responsibility

• Each scenario has an owner on the business side.
• The procedure for analyzing the incident is described: who looks at the logs, who makes the decision, how the index is rolled back.
• There are internal rules for using AI, and employees are aware of them.