Architecture and Key Concepts

Workforce AI Security is managed through the Check Point Portal and provides centralized visibility, governance, and protection for all generative AI activity across an organization. It continuously monitors how employees interact with AI tools, such as web-based chats, desktop applications, IDE assistants, and Model Context Protocol (MCP) agents, and applies security and data-protection policies in real time.

This topic describes the service architecture and the key concepts used throughout Workforce AI Security.

Service Architecture

Workforce AI Security operates across three primary layers:

1. Endpoint Monitoring Layer captures AI-related user actions on devices and forwards them to the cloud for analysis. It includes:

   • Browser extension – Monitors AI activity in web-based chats and tools.

   • Desktop proxy/client – Monitors desktop AI apps (ChatGPT Desktop, coding assistants, etc.).

   • IDE and developer tool integrations – Detects activity in environments that support AI-powered coding features.

   • MCP server visibility – Observes operations performed by agentic workflows via Model Context Protocol servers.

   These components collect interactions such as prompts, file uploads, pasted text, and agent tool invocations, depending on the user’s permissions and the system’s privacy settings.

2. Policy and Classification Engines evaluate each AI interaction. Policies are applied to different aspects of AI usage:

   • Access Policies – Decide if access to AI applications is Allowed, Asked, or Blocked for specific users, groups, or the entire organization.

   • Chats Policies (DLP) – Apply content-level decisions (Allow, Ask, Block, Prevent, Detect) based on Data Types that represent sensitive content.

   • Agent Policies – Control MCP servers and tools, including prompt injection protection, URL/file reputation, and content moderation modes.

   Policy actions share a common behavior model documented as Allow, Ask, Block, Detect, or Prevent, each with a defined impact on data flow and user experience.

   Data Types Classification provides the detection layer for sensitive content and includes:
   

   • Predefined Data Types

   • Custom Data Types

   • Check Point Recommended groups

   • Matching criteria (Pattern, Keyword, Dictionary, Weighted Words, Template, File Attribute)

3. Management & Governance Layer (Check Point Portal) - Administrators manage policies, monitor activity, and view organizational insights through the management portal. This layer provides:

   • Dashboards and analytics

   • Application and agent discovery

   • Event logs

   • Policy configuration (Access, Chats/DLP, Agents)

   • Role-based access and sensitive prompt visibility

Key Terminology

Term	Description
AI Application	Any generative AI tool used through a web browser or desktop client.
MCP Server	A service that exposes tools, resources, or APIs to AI agents so they can perform actions beyond simple text generation.
Agent	An automated workflow powered by an AI model that may call external tools or perform CRUD operations through an MCP server.
Use Case	The functional purpose of the AI interaction, such as code generation, analytics, email drafting, or customer communication.
Sensitive Data Type	Patterns representing regulated, confidential, or organization-specific data. These are used to enforce DLP policies.
Managed vs. Unmanaged Applications	Managed: Applications configured with an organizational license. Unmanaged: Personal or external AI tools not under corporate control.
Risk Levels	A classification of AI applications or sessions (critical, high, medium, low, etc.) based on security posture and observed activity.

Data Flow Summary

The system processes AI activity through the following sequence:

1. User interacts with an AI tool (web, desktop, IDE, MCP agent).

2. Endpoint components capture the interaction (depending on permissions).

3. Data is sent to the cloud analysis engine for:

   • Risk evaluation

   • Sensitive data detection

   • Use case classification

4. Policy rules are applied based on Access, Chats/(DLP), or Agents policies.

5. The system enforces an action (Allow, Block, Ask, Prevent, Detect).

6. Events are logged and become visible in dashboards and analytics.

7. Administrators review insights to adjust governance as needed.

This unified flow ensures visibility, governance, and protection across all AI usage in the organization.

Public APIs

Workforce AI Security provides public REST APIs that allow you to integrate Workforce AI Security with external systems and automation tools.

These APIs are intended for advanced use cases, such as:

• Automating security workflows

• Integrating Workforce AI Security with SIEM, SOAR, or reporting systems

• Building internal tools that consume Workforce AI Security data

Using the APIs is optional. All standard administration tasks can be performed through the user interface.

Key characteristics

• Stable and production‑ready - The APIs are versioned and designed to remain backward compatible, making them suitable for long‑term automations and integrations.

• Secure authentication - API access is authenticated using an account API key and JWT.

• Account‑scoped access - API operations are limited to your organization's account. The APIs cannot be used to access data outside your organization.

• Supported and documented - The APIs are publicly documented using the OpenAPI 3.1 specification and published on SwaggerHub, providing a consistent and up‑to‑date reference for available endpoints and parameters.

API documentation

The full Workforce AI Security API specification is available at - https://app.swaggerhub.com/apis/Check-Point/checkpoint-ai-security