A policy proposal for controlling external AI use
Jake Tae-moon Jo · Engineering lead · https://jake-jo-portfolio.vercel.app/en/work/ai-usage-policy/
Wrote, as an approval request, a control policy in which a company uses external AI through channels it owns and classifies only its top prohibited tier; its 90-day goal of at least 3 company-controlled AI channels was reached (my own account). Under the rule of no policy text before the diagnosis, the text was left as a hypothesis pending diagnosis.
- Period
- Jul – Aug 2026
Problem and context
The client needed channels and rules for using external AI at company level. The first question was what may go into external AI at all, and I started the approval request from there.
I downgraded the policy text to a hypothesis soon after writing it. The charter sets the order rule that no policy text is written before the diagnostic data arrives. The reset consisted of a three-stage model, a team of 5 agents, diagnostic tools and a tracker of 6 regulatory and contractual facts to settle.
The policy documents, in order
The policy documents are numbered evidence → controls → approval request. After the downgrade to a hypothesis the next day, the adoption comparison and the rollout plan followed.
- Strategy review · regulatory check
6 strategies (A–F) · 4 rules and contracts · 12 verified findings
- Data-control policy · security approach
6 threat models · 4 control layers · 90-day roadmap
- Approval request
One page: risk → proposal → 3 decisions
- Downgraded to a hypothesis
Jul 23 · no policy text before the diagnosis
- Adoption comparison · rollout plan
2 scenarios · 11-step rollout (Aug 5–6)
What I built
- An approval request. One page holding risk, proposal and three decisions; I downgraded it to a hypothesis on July 23.
- A data control policy and a security approach: 6 threat models, 4 control layers and a 90-day roadmap.
1 more
- A strategy comparison and a regulatory check. It compares 6 strategy types (A to F), reviews 4 regulations and contracts and lists 12 verified findings.
2 more
- An asset-tagging board: a static HTML board that looks up an inventory of 36 assets by class in 3 seconds, a CSV, and a shell script that checks the schema and the invariant that the top prohibited class means prohibited.
- Rollout comparison and execution documents. They compare two scenarios over 14 pages plus 5 appendices, and add an 11-step sequence for the chosen hybrid, with an application form, a notice, an account-switch guide, a receipt-forwarding rule and a tracker.
Key decisions
The company owns the channel; classification applies only to the top prohibited classDecision I compared 6 strategy types and chose a hybrid.Result On July 23 the five policy documents were downgraded to hypotheses, and the charter set the rule that no policy text is written before the diagnostic data arrives.
- Problem
- The question was how to control external AI use. Classifying every asset and controlling by class is a documented failure pattern, because the upkeep becomes too heavy.
- Options considered
- Decision
- I compared 6 strategy types and chose a hybrid. The proposal has the company own the external AI channel and applies asset classification only to the top prohibited class (P3). Data-loss-prevention tooling, detection of unapproved AI use, authentication, a governance committee and a de-identifying proxy were deliberately left out of the proposal; the approval request lists them under "what this proposal does not do", with the conditions for revisiting each.
- Result
- On July 23 the five policy documents were downgraded to hypotheses, and the charter set the rule that no policy text is written before the diagnostic data arrives. The approval request's 90-day goal was to have at least 3 company-controlled AI channels, and that goal was reached.
- Cost & remaining risk
- Under the proposal, with no detection tool, control would rest on providing the channel and prohibiting the top class. It is also a hypothesis that diagnostic data has not yet tested.
Project facts
- Period
- Jul – Aug 2026
- Role
- Only human on the build team; designed and ran the AI agent team
- Team
- Just me (the only commit author in the policy repository)
- Platforms
- Policy documents · asset-tagging board
- Stack
- Markdown · Static HTML · CSV · Shell
- Context
- Policy proposal work for a client that wanted to use external AI at company level
Results
The request's 90-day goal of at least 3 company-controlled AI channels was reached (my own account), and the policy text was left as a hypothesis pending diagnosis.
- The approval request's 90-day goal, at least 3 company-controlled AI channels, was reached (my own account). The policy text was downgraded to a hypothesis the day after it was written, with the rule that no policy text is written before the diagnostic data arrives.
- In the 15 days from the policy draft (July 22) to the rollout documents (August 6) I wrote the approval request, the control policy, the strategy comparison, the asset-tagging board and the rollout comparison and sequence.
The policy documents are proposals downgraded to hypotheses. The goal was reached by my own account, with no dated record or channel list, so no result metrics are given.
From the draft to the rollout sequence in 15 days
The policy was downgraded to a hypothesis the day after it was written, the order became no policy text before diagnostic data, and only the rollout comparison and sequence followed.
- Policy draft
Policy, asset tagging, security approach
- Downgraded to hypotheses, plan reset
Five drafts downgraded; a charter, a team of 5 agents and a regulatory fact tracker set up
- First weekly brief
2 more
- Account switch guide
- Rollout options and sequence
Two scenarios compared, a hybrid chosen and an 11-step sequence written (file dates Aug 5–6)