What this usually includes
What we can take on
- AI acceptable-use and data-handling guidance
- Approved-tool and account strategy
- Shadow-AI discovery and risk discussion when included in the engagement
- Identity, permissions and data-access review
- Prompt / output handling guidance
- Human-in-the-loop controls
- Logging and audit considerations
- Vendor / model risk review when included in the engagement
When clients bring us in
- Employees already use public AI tools with work data
- Different teams are buying separate AI subscriptions
- Copilot or agents will access sensitive information
- Leadership wants a policy that is usable, not just restrictive
How we handle the work
AI governance should make safe work easier, not push people toward hidden workarounds. We define what data can be used, what tools are approved, where human approval is required, and who owns exceptions.
Security responsibilities are documented. The customer should know what is monitored, which actions Orbiwest can take, which actions require approval, and how to access the relevant reporting and tools.