Approved tools and data classification

People do not route around controls because they are reckless. They route around controls because the sanctioned path is slower than the deadline allows, and because the harm from using an unapproved tool is invisible and deferred while the harm from missing the deadline is visible and immediate. Given that asymmetry, the rational choice for an individual is the one that damages the organisation.

The correction is to approve a route rather than a tool, and to make sure the route includes a fast way to ask for something new.

Definition

An approved route is four things stated together for a given class of work: the classification of data permitted, the destination it may reach, the retention that applies once it arrives, and the request lane for work the route does not cover. Any policy missing the fourth element will be routed around, because a person with an uncovered task and a deadline has nowhere to go but outside.

The unit of approval is the route, not the tool. A tool is approved for nothing in general and something in particular. The same product can be an approved destination for internal drafting and a prohibited one for customer records, and stating it that way removes the argument about whether the tool is safe, which is a question with no answer.

When to Use It

Define routes before a tool arrives, not after. Redefine them when a tool gains a new feature that changes its destination, when a supplier changes sub-processors, and whenever the request lane produces the same request three times, because three identical requests mean a route is missing.

Use the request lane as your primary instrument. A lane with no traffic is not evidence of compliance: it is evidence that people have found somewhere else to go.

How to Apply It

1. 1Classify data by what happens if it leaks, in words your colleagues already use, not by a scheme that needs a lookup table.
2. 2State the destination as a named account and tenancy, because the same product under a personal login is a different destination.
3. 3State retention and training use explicitly, including whether the destination retains prompts and for how long.
4. 4Publish a request lane with a named responder and a stated turnaround, and measure the turnaround rather than the compliance rate.

Worked example 1 of 3

OmniCorp Logistics banned consumer AI tools after a data review. Four months later Priya Raghunathan surveyed her dispatch teams and found that AI use had risen, not fallen.

PRPriya Raghunathan

You know the tools are not approved. Walk me through what happens at four o'clock on a bad Friday.

DSDispatch supervisor

I have forty customer notifications to write and forty minutes. The approved route is a template in the portal that does not fit half these cases.

PRPriya Raghunathan

And when it does not fit?

DSDispatch supervisor

I use my phone. Paste the shipment details, get the wording, retype it in.

PRPriya Raghunathan

Shipment details meaning addresses and customer names.

DSDispatch supervisor

Yes. I know. There was nowhere to ask for anything better, so I stopped asking.

Priya's response was not enforcement. She built a route: confidential class, enterprise tenancy with training use disabled, thirty-day retention, and a request lane answered within two working days by a named person. Consumer-tool use in dispatch fell to near zero inside a month, because the approved path was now the fast one.

Why This Works

The route removes the asymmetry that drives the behaviour. When the sanctioned path is at least as fast as the alternative, the deferred, invisible risk no longer has to compete with an immediate, visible deadline, and people choose the approved option without needing to be virtuous about it. Controls that rely on individuals absorbing a cost fail on their worst day, which is the day they matter.

Naming the destination as an account rather than a product works because it makes the most common breach legible. Nobody thinks of opening the same familiar interface on a personal login as changing destination. Stating tenancy explicitly is what turns that from an oversight into a decision.

Alan Brixmoor at OmniCorp Public was asked to enable AI drafting for benefits correspondence, which involves health information, financial circumstances and children's details. He built the route before evaluating any product.

Classification: correspondence content was restricted class, because it routinely contains health and children's data, while the process guidance the team also drafted was internal class. Two classes, two routes, and the separation is what made the rest tractable.

Destination: internal class went to the enterprise tenancy immediately. Restricted class went nowhere for eleven weeks, until a deployment could be stood up in region with training use contractually disabled and sub-processors enumerated. Retention: thirty days for internal, seven for restricted, both verified by asking the supplier to demonstrate deletion rather than assert it. The demonstration failed the first time, which was the single most valuable thing the exercise produced.

Request lane: a named responder, three working days, published alongside the route. In the first quarter it received twenty-six requests. Three revealed uses already running that had never been declared, and two were approved as new routes within a fortnight. Alan's assessment was that the lane, not the restriction, was what brought the shadow work into view.

Four elements and a working lane will hold a team's data where it belongs. They will not survive contract negotiation with a supplier who will not enumerate sub-processors, a cross-border transfer question, or an auditor asking you to prove deletion actually occurred rather than that it was promised. Turning a route into contractual and technical assurance you can evidence is the capability the paid programs develop next.