Manage Interactions

Workforce AI Security enforces security policies across several planes that operate on all Manage Interactions pages - Access, Chats, and Agents. These planes work together to provide layered protection for AI-driven workflows.

Policy configuration is hierarchical:

  1. App-level Access Policy defines the basic permissions for apps and what each app is allowed to do.

  2. Agent-level Access Policy defines what agents can do (specific to the Agentic Platform) in terms of behavior, that is, what an agent is allowed to do.

  3. Data Loss Prevention (DLP) / Chat Policy determines rules on sensitive data and decides what must be blocked. At this level, data-type restrictions are configured, such as: blocking certain information types, content categories, and sensitive data.

Policy Layer Overview

Workforce AI Security uses a layered policy model to allow flexible governance depending on the use case.

1. Access Policies — Application-Level Control

These determine whether a user is allowed to access a specific AI application.

Examples:

  • Allow all AI apps except a blocklisted set

  • Allow only approved AI tools (allow-list mode)

  • Apply different rules to corporate vs. personal AI accounts

2. Chats / DLP Policies — Content-Level Control

These policies inspect the content being sent to AI systems and enforce actions such as:

  • Allow

  • Block

  • Detect (log only), etc.

They use data types and classification rules to identify sensitive or regulated information.

When a policy blocks or prevents an interaction, the user receives a notification explaining the reason for the action. The notification can include details about the sensitive data types that triggered the policy (for example, email addresses or credentials), helping users understand and correct their input.

3. Agent Policies — Tool-Level Control for MCP Agents

These policies govern the tools, operations, and external resources exposed by MCP servers. Administrators can:

  • Restrict or allow MCP tools

  • Enforce URL and file reputation checks

  • Apply content moderation controls

This prevents unauthorized or risky operations executed by AI agents.