Before
Analysts had to search for provider policies and risk indicators, combine usage and application details, and prepare the review evidence separately. They then had to copy the assessment into the registry and initiate the approval handoff.
How it works
- Collect the application profile, observed usage signals, provider confidence information, and policy evidence.
- Generate a risk assessment, validate it against fixed recommendation and data-level rules, and apply deterministic fallback checks when needed.
- Update the application registry and send the validated assessment into the security and privacy review process.
Workflow details
- Evidence collection: The flow receives the application profile and registry identifier, retrieves provider confidence information, and combines observed users, sources, DLP alerts, hosting, certifications, domains, breach indicators, and web-based policy findings into a concise evidence dossier.
- Risk assessment: An AI assessment produces a risk score, risk level, permitted data level, recommendation, rationale, key facts, vendor, hosting information, and a possible internal alternative based only on the supplied evidence.
- Policy safeguards: Fixed checks validate recommendation values, constrain risk scores to 0–100, enforce consistency between recommendations and permitted data, and apply fallback rules when the AI response is unavailable or malformed. Hosting in China, a known breach, or a very low provider confidence score can result in blocking; lower confidence can result in tolerance, while other cases default to restriction.
- Review handoff: The validated assessment is written to the AI application registry with its risk, rationale, evidence, category, hosting, vendor, and domains, then passed to the security and privacy approval workflow. The result informs reviewers but does not approve the application.
What changed
Each detected application now receives a structured, policy-checked assessment before the registry is updated. Reviewers receive the evidence, recommendation, risk score, and rationale through the approval workflow, while the human approval decision remains separate.
Work removed
Searching for provider evidence, compiling usage and risk facts, checking recommendation and data-level consistency, applying fallback thresholds, copying the evidence and assessment into the registry, and manually opening the approval handoff.
Expected outcome
The workflow can remove at least two recurring manual actions per application—assembling the evidence pack and updating or routing the review record—while producing a more consistent review package.
