GOVERNED AI POLICY BUILDER
Twelve answers. One AI policy, with the control behind every line.
A customer questionnaire, an insurer or an auditor asks for your AI use policy, and the honest answer is that there is a paragraph in the handbook nobody enforces. Answer twelve questions about your tools, your data, who may use AI, what may go to a customer, and whether an agent may act on its own, and this page writes the first draft: every clause paired with the control that makes it true (a named Microsoft capability with the date it was checked, the setting in your own tools, or a person and a log), and a plain list of what the policy states that nothing enforces yet. It works for Microsoft 365, Google Workspace and mixed stacks. No email is needed.
TWELVE QUESTIONS
Answer twelve questions. The policy writes itself, with its controls.
Every answer is a choice except your organization's name, which you can leave blank. The draft is written on this page the moment you finish and gets an address of its own. Your counsel reads it before anyone adopts it. Do not enter customer records or credentials.
Keep a copy in your inbox.
Enter a work email, company and role to receive this draft as text with its address. This records an SIT inquiry for follow-up, and the engineer reads it before any call. Marketing emails require a separate choice.
YOUR REGISTER
What this browser has worked out so far.
Kept in this browser only; nothing on this list is stored on our server. Each line opens its own address, so you can come back to it, send it to the owner, or clear it. The procurement pack binds every line into one PDF, rebuilt from the addresses when you press the button, with a cover and a contents list.
WHAT IT IS
What is a governed AI policy?
One page that says which tools are approved, what never goes into a prompt, who approves what goes out, what an agent may do alone, how long logs are kept, and who owns the whole thing, with the control that enforces each line written next to it.
The second half is what makes it governed. A policy that says "no customer data in AI tools" and names nothing that stops it is a wish. The builder pairs every clause with the product setting, the Microsoft capability with the date it was checked, or the honest words "a person and a log".
THE INSIGHT
Why does every clause need an "enforced by" line?
Because the usual audit finding is a policy that states more than the tools enforce, and the gap between the two is where the incident happens.
Microsoft Defender for Cloud Apps lists generative AI apps as a category, and an app tagged Unsanctioned is blocked on devices onboarded to Microsoft Defender for Endpoint, with up to three hours of propagation. (Microsoft Learn, checked Oct 31, 2026)
Write the enforcing control next to the clause and the auditor reads a system. Leave it out and the auditor reads a promise, and so does the person about to paste a client file into a free account.
HOW IT WORKS
How does the builder write the policy?
From a clause library, not a model: each of the twelve answers switches clauses on or off and chooses the enforcing control for your platform, so every line traces to an answer and, on Microsoft 365, to a dated register entry.
- You answer twelve questions on the page; nothing is sent anywhere.
- The page writes the clauses that apply, grouped in eight sections, each with its enforcing control, then the rules that apply and an acknowledgment page, and you download it as Word or PDF.
- The gap list names what the policy states that nothing enforces yet, and what switches it on.
- Your counsel reviews the draft before it is adopted; the builder is not legal advice.
ANY STACK
What if we run Google Workspace or a mix of tools?
Then every "enforced by" line names the Workspace setting or the tool's own control, and the clauses that no product enforces say so plainly, because the clause is the same in every stack and only the control differs.
Microsoft 365 shops get the Defender app category, the Purview DLP location for Copilot, the weekly oversharing assessment and Agent 365, each with the date it was checked. Google shops get Drive DLP, the sharing audit and Gemini assignment by organizational unit. Everyone gets the business-plan rule, the approval step and the inventory.
YOUR DATA
What happens to the answers?
They are rendered on the page and encoded in the policy's address, and nothing is stored unless you ask for the email, in which case the lead is recorded through the same intake as the contact form.
The only free text is your organization's name, and you can leave it blank. Do not enter customer records or credentials.
THE MONEY
What is free and what is paid?
The draft is free. Making every "enforced by" line true in your tools, marked tested instead of assumed, is the ten-hour foundation, and anything built after that is scoped from it.
No price appears on this site; the engagement is quoted after a scoping call, assessment separate from implementation.
AFTER TWO WEEKS
What will be working after two weeks?
- You hold an AI policy with eight sections, from definitions and the three-tier tool list to consequences and good-faith reporting, the control behind every clause, and an acknowledgment page, as Word or PDF.
- The gap list says, in plain words, what the policy promises that nothing enforces yet.
- The agent inventory clause and the approval clause match the simulator and the blueprint, so the three documents agree.
- The draft has its own address, and counsel can read it before anyone adopts it.
HONEST ABOUT LIMITS
What this does not do yet
It does not know what is switched on in your tenant. A Microsoft Purview DLP policy with the Microsoft 365 Copilot and Copilot Chat location stops Copilot and Cowork from processing files and emails that carry chosen sensitivity labels; the item can still appear as a citation. This needs Microsoft 365 E5 or the Purview suite. (Microsoft Learn, checked Oct 31, 2026) That control needs the right license and a configured policy; the builder names it, and the ten-hour foundation checks it.
It does not test a control: a Purview policy or a browser block is named, not checked, until read-only discovery checks it.
It is not legal advice and does not replace counsel's review.
THE ONE THING TO REMEMBER
A policy is only as real as the control next to each clause.
Said another way: write the enforcing control beside the promise, or the promise is the gap.
Said a third way: seven sections, one owner, one gap list, in your tools.
DIRECT ANSWERS
Questions before you decide.
Do I need an email to see the policy?
No. The draft renders on the page and has its own address. The email is only for keeping a copy and it records a lead through the normal intake.
Is the policy written by an AI?
No. It comes from a clause library, so every line traces to the answer that switched it on and to the control named beside it. A model may tailor wording in a later version, under the same rules.
Is this legal advice?
No. It is a first draft of an operating policy with its enforcing controls. Your counsel reviews it before it is adopted, and the rule you named wins wherever the two differ.
How does it relate to the simulator and the blueprint?
The simulator shows one task running with the approval step. The blueprint plans one workflow. The policy is the page that says those rules apply to everyone, with the control behind each one.
How is the work priced after this?
Quoted after a scoping call. The foundation is ten hours at every size of firm and the build is scoped from it. No price appears on this site.
NEXT STEP
Start with a boundary you can explain.
Choose a focused check, or speak with the team about the workflow you need to improve.