This pack records how staff at Sample Institution (fictional) used AI tools from 01 Jul to 30 Sep 2026. It also records the controls that applied. All figures are sample data.

Findings

1. AI use is wide and mostly outside approved tools. Staff used 63 AI apps. Only 3 are sanctioned. 42 are unsanctioned, including 2 unlisted LLM endpoints found by behaviour (page 4).
2. Personal accounts are common. 41 of 63 apps had sessions from personal accounts. Marketing and Human Resources had the highest share (page 5).
3. Regulated data left through personal and unsanctioned paths. 212 prompts carried regulated data to an unsanctioned app or a personal account. Customer PII (64), source code (42) and Emirates ID (38) led (page 6).
4. Agents can change systems. 9 agents and MCP servers run on staff endpoints. 4 have write access. 2 had no named owner at discovery (page 7).
5. Coaching works. SentraGuard logged 20,049 decisions: 18,402 allow, 1,207 coach, 388 redact and 52 block. Weekly coach events peaked at 190 in week 2 and fell to 47 in week 13 (page 8).

Recommendations

1. Move personal-account use of ChatGPT, Gemini and Claude to ChatGPT Enterprise and Microsoft 365 Copilot. Set Coach for 30 days, then Block for personal accounts on these apps.
2. Put the 4 write-capable agents under tool-call policy. Give each one a named owner, an approver and an expiry date.
3. Turn on Redact for Emirates ID, IBAN and card number on all tolerated apps. Keep Block for regulated data on unsanctioned apps.

Pilot week and timeline

Method

SentraGuard matches traffic against its app dictionary. It flags unknown LLM endpoints by behaviour. It compares the signed-in account with the SSO identity to split corporate and personal use. It inspects three lanes: prompt, paste and upload. Each inspected event gets one decision: Allow, Coach, Redact or Block.

Out of scope. Mobile devices. A one-week pilot pack uses the same structure for one business unit.

63 AI apps were used in the period. This page lists the 15 with the highest risk or use. The CSV export lists all 63.

Figure 1. Sessions per app, 01 Jul to 30 Sep 2026. Sample data.

41 of 63 AI apps had at least one session from a personal account.

A personal-account session is one where the account signed in to the AI app does not match the user's SSO identity. Data sent this way sits outside the institution's contracts, retention rules and audit trail.

Figure 2. Users per unit in brackets. Sample data.

What the split shows

• Marketing, 58% Staff use personal accounts for design and copy tools. Canva AI and ChatGPT lead.
• Human Resources, 47% Staff use personal accounts for meeting notes and letters. This includes candidate data.
• Risk and Compliance, 12% Most use goes through Microsoft 365 Copilot.
• Largest gap in volume Retail Banking and Operations have the most users with personal-account sessions.

212 prompts carried regulated data to an unsanctioned app or a personal account.

SentraGuard inspects three lanes: typed prompts, pastes from the clipboard, and file uploads. Each event below also appears in the policy decision log with its timestamp, user and action.

Figure 3. Prompts with regulated data, 01 Jul to 30 Sep 2026. Sample data.

Counting rule. One prompt counts once, under its most sensitive data class. Redact and block counts on page 8 cover all apps, including sanctioned ones, so they are higher.

9 agents and MCP servers were found. 4 have write access.

The endpoint agent and IDE extensions list each agent, the tools and MCP servers it can call, and the data those tools reach. Agent tool calls get the same four actions as prompts: Allow, Coach, Redact and Block.

Actions taken in the period

• Owners Every agent now has a named owner group.
• Write tools Tool calls that write or send now run under Coach. Calls that send regulated data outside the domain are blocked.
• Register Both local models were added to the asset register.

SentraGuard logged 20,049 policy decisions in the period.

Figure 4. Two scales: Allow on the top panel, the other actions below. Sample data.

Each decision in the log has a timestamp, user, role, business unit, app, account type, lane, data class and action. The log streams to the institution's SIEM (Microsoft Sentinel in this sample).

6 exceptions were in force at the end of the period.

An exception lets a named group use an app or tool outside its default class. Each exception has a scope, a reason, an approver and an expiry date. SentraGuard applies the exception by user group and returns to the default policy on expiry.

Register controls

• Expiry No exception runs longer than 6 months. Owners get a reminder 14 days before expiry.
• Review EX-06 is under review because the tool can send mail. It stays limited to the institution's domain until the CISO decides.
• Evidence Every decision made under an exception carries the exception id in the decision log.

This map links UAE regulatory expectations to the evidence in this pack.

How to read this map. The map shows where this pack holds evidence that supports a control area. It uses general terms, not clause numbers. It is not legal advice or a compliance opinion. The institution's compliance team decides which rules apply.

This map is for institutions that also operate in Saudi Arabia, and for international standards.

Saudi Arabia

International

How to read this map. The map shows where this pack holds evidence that supports a control area. It uses general terms, not clause numbers. It is not legal advice or a compliance opinion. The institution's compliance team decides which rules apply.

SentraGuard signed this export at creation. Anyone can check that the file has not changed.

Export id

SG-EXP-2026Q3-000417

Document id

SG-EP-SAMPLE-2026Q3-001

Created

2026-10-01T06:00:00+04:00 (Gulf Standard Time)

Period covered

01 Jul to 30 Sep 2026

Contents

AI app inventory, user and role attribution, policy decision log, exceptions and approvals, regulator clause map. Formats: PDF, CSV, SIEM feed.

SHA-256 of export file

3f9a0c7e51b24d8a96e0f13c7b5a29d4e8c160f7a3b95d2e4c07f81a6d3b9e25c

Signing key fingerprint

SHA256:7Q2mX9vK4pR1tLw8eN3sB6yH0cJ5dF2gA9uZ4oV7iM1

The hash and fingerprint above are fictional. They show the format only.

How to verify

1. Get the export file and its signature file from the institution's SentraGuard console or SIEM archive.
2. Compute the SHA-256 hash of the export file with a standard tool, for example sha256sum on Linux or certutil -hashfile on Windows.
3. Compare the result with the hash above. One changed byte gives a different hash.
4. Check the signature file against the public signing key. Confirm that the key fingerprint matches the one above.
5. Record the result, the date and the name of the reviewer in the audit file.

Methodology note

Data comes from the SentraGuard browser plugin, IDE extensions and endpoint agent, as described on page 3. Users and roles come from SSO and SCIM at the time of each event. Apps are matched against the SentraGuard app dictionary. Unknown LLM endpoints are flagged by behaviour. Counts on page 6 count each prompt once. Counts on page 8 count each decision once. Figures are not rounded. Times are Gulf Standard Time.