[{"data":1,"prerenderedAt":1244},["ShallowReactive",2],{"site-nav-content":3,"blog:/blog/what-is-write-back-governance":163,"blog-index-copy":746,"blog:/blog/what-is-write-back-governance:surround":767,"hiring-banner-content":1213,"site-cta-content":1225},{"header":4,"productNav":9,"nav":42,"footer":61,"askAI":116,"id":147,"title":148,"archived":149,"authors":150,"badge":150,"body":151,"date":150,"department":150,"description":155,"extension":158,"eyebrow":150,"faqHeader":150,"faqs":150,"footerBand":150,"headline":150,"image":150,"industry":150,"jobType":150,"listed":149,"location":150,"navigation":115,"openRoles":150,"pageLayout":150,"path":159,"relatedHeading":150,"seo":160,"series":150,"sitemap":115,"status":150,"stem":161,"subhead":150,"tags":150,"video":150,"whyJoin":150,"workplaceType":150,"__hash__":162},{"productLabel":5,"loginLabel":6,"contactLabel":7,"contactSalesLabel":8},"Product","Log in","Contact","Get started for free",[10,14,18,22,26,30,34,38],{"label":11,"to":12,"description":13},"Overview","/overview","Seven layers. One closed loop.",{"label":15,"to":16,"description":17},"Conflux","/product/conflux","Where your team, workstreams, and agents meet.",{"label":19,"to":20,"description":21},"Agent Teams","/product/agent-teams","Specialist teams - governed from day one.",{"label":23,"to":24,"description":25},"Lifecycle Graph","/product/lifecycle-graph","Intelligence that compounds across every interaction.",{"label":27,"to":28,"description":29},"Company Wiki","/product/wiki","Playbooks and policies where expertise stays.",{"label":31,"to":32,"description":33},"Workstreams","/product/workstreams","From brief to signed-off deliverable on one canvas.",{"label":35,"to":36,"description":37},"Perception Console","/product/perception","Ask your whole business in plain English.",{"label":39,"to":40,"description":41},"Governance","/product/governance","Frontier AI you can actually sign off on.",[43,46,49,52,55,58],{"label":44,"to":45},"Models","/models",{"label":47,"to":48},"Pricing","/pricing",{"label":50,"to":51},"Integrations","/integrations",{"label":53,"to":54},"Security","/security",{"label":56,"to":57},"Partners","/partners",{"label":59,"to":60},"Insights","/blog",{"productHeading":5,"companyHeading":62,"legalHeading":63,"docsLabel":64,"docsUrl":65,"statementLines":66,"copyright":69,"companyLinks":70,"legalLinks":85,"socialLinks":95,"bottomLinks":105},"Company","Legal","Docs","https://docs.gonimbus.ai",[67,68],"Stop training someone else's model.","Control your AI.","© 2026 Nimbus Intelligence, Inc. All rights reserved.",[71,72,73,74,75,77,80,83],{"label":47,"to":48},{"label":50,"to":51},{"label":53,"to":54},{"label":59,"to":60},{"label":76,"to":57},"Partner Program",{"label":78,"to":79},"Careers","/careers",{"label":81,"to":82},"System status","/status",{"label":7,"to":84},"/contact",[86,89,92],{"label":87,"to":88},"Terms of Service","/terms",{"label":90,"to":91},"Privacy Policy","/privacy",{"label":93,"to":94},"Compliance","/compliance",[96,99,102],{"label":97,"href":98},"LinkedIn","https://www.linkedin.com/company/gonimbusai/",{"label":100,"href":101},"X","https://x.com/gonimbusai",{"label":103,"href":104},"Instagram","https://www.instagram.com/gonimbus_ai/",[106,108,110,111,112],{"label":107,"to":88},"Terms",{"label":109,"to":91},"Privacy",{"label":93,"to":94},{"label":81,"to":82},{"label":113,"to":114,"external":115},"LLMs.txt","/llms.txt",true,{"text":117,"prompt":118},"Ask AI about Nimbus",{"I'm researching enterprise intelligence platforms and want to know how Nimbus combines perception, collaboration, and autonomous agents to drive strategic decision-making":119,"platforms":121},{" Summarize the highlights from Nimbus's website":120},"https://gonimbus.ai",[122,127,132,137,142],{"name":123,"label":124,"icon":125,"hrefPrefix":126},"chatgpt","ChatGPT","simple-icons:openai","https://chatgpt.com/?prompt=",{"name":128,"label":129,"icon":130,"hrefPrefix":131},"perplexity","Perplexity","mdi:magnify","https://www.perplexity.ai/search/new?q=",{"name":133,"label":134,"icon":135,"hrefPrefix":136},"grok","Grok","simple-icons:x","https://x.com/i/grok?text=",{"name":138,"label":139,"icon":140,"hrefPrefix":141},"claude","Claude","simple-icons:anthropic","https://claude.ai/new?q=",{"name":143,"label":144,"icon":145,"hrefPrefix":146},"google-ai","Google AI","simple-icons:google","https://www.google.com/search?udm=50&aep=11&q=","content/shared/nav.md","Site navigation",false,null,{"type":152,"value":153,"toc":154},"minimark",[],{"title":155,"searchDepth":156,"depth":156,"links":157},"",2,[],"md","/shared/nav",{"title":148,"description":155},"shared/nav","p6IsjEfjcrwkjwvGsPcuEkpoJSeUn2vJXPTxLWQfw9M",{"id":164,"title":165,"archived":149,"authors":166,"badge":169,"body":171,"date":735,"department":150,"description":736,"extension":158,"eyebrow":150,"faqHeader":150,"faqs":150,"footerBand":150,"headline":150,"image":150,"industry":150,"jobType":150,"listed":149,"location":150,"navigation":115,"openRoles":150,"pageLayout":150,"path":737,"relatedHeading":150,"seo":738,"series":739,"sitemap":115,"status":150,"stem":740,"subhead":150,"tags":741,"video":150,"whyJoin":150,"workplaceType":150,"__hash__":745},"content/blog/what-is-write-back-governance.md","What is Write-Back Governance",[167],{"name":168,"to":120},"Nimbus Research",{"label":170},"Explainer",{"type":152,"value":172,"toc":709},[173,182,189,192,208,223,228,280,294,298,305,308,322,325,357,360,367,372,379,386,389,392,395,399,409,419,430,436,457,461,467,473,479,485,491,497,507,515,523,527,533,538,546,550,554,560,564,567,571,574,578,589,593,596,600,607,611,614,618,621,625,628,632,638,642,650,654,657,661,669,673],[174,175,176,177,181],"p",{},"Write-back means the AI is allowed to ",[178,179,180],"strong",{},"change"," a live business system — a CRM field, an ERP journal, a customer message — not just draft a suggestion.",[174,183,184,185,188],{},"Write-back governance is the control that decides whether that is allowed, exactly what will change, who must sign, and how you can prove it later. Its defining property is ",[178,186,187],{},"fail-closed",": if approval is missing, the write does not occur.",[174,190,191],{},"A prompt that says “please ask first” is etiquette. It is not a control.",[174,193,194,195,202,203,207],{},"In June 2023, a New York federal judge sanctioned two lawyers who filed a brief citing cases ",[196,197,201],"a",{"href":198,"rel":199},"https://www.reuters.com/legal/new-york-lawyers-sanctioned-using-fake-chatgpt-cases-legal-brief-2023-06-22/",[200],"nofollow","ChatGPT had invented"," — the ",[204,205,206],"em",{},"Mata v. Avianca"," episode. Fiction had been written into a court record. The same failure mode is waiting in CRM and ERP: fluent output that becomes an operational fact.",[174,209,210,211,216,217,222],{},"Air Canada’s chatbot invented a bereavement fare and the company was held to the commitment — ",[196,212,215],{"href":213,"rel":214},"https://www.cbc.ca/news/canada/british-columbia/air-canada-chatbot-lawsuit-1.7116416",[200],"CBC",", decision ",[196,218,221],{"href":219,"rel":220},"https://decisions.civilresolutionbc.ca/crt/crtd/en/525448/1/document.do",[200],"Moffatt v. Air Canada",". A customer-facing message is a write to the relationship even when no CRM API fired.",[224,225,227],"h2",{"id":226},"words-youll-hear","Words you’ll hear",[229,230,231,238,244,250,256,262,268,274],"ul",{},[232,233,234,237],"li",{},[178,235,236],{},"Live system / system of record."," Salesforce, NetSuite, Workday — the official place the number or record lives. At work, this is where other teams will inherit the new value.",[232,239,240,243],{},[178,241,242],{},"Payload / quote."," The exact change, shown before it runs: fields, values, line items — not “update CRM.” At work, Amount and a next-step note are not the same quote.",[232,245,246,249],{},[178,247,248],{},"Named signer."," The identity that authorised the payload. Shared inboxes and “whoever is online” destroy this.",[232,251,252,255],{},[178,253,254],{},"Maker-checker."," An older control: one person proposes, another authorises. Write-back governance is that instinct for AI, when the proposer is a model.",[232,257,258,261],{},[178,259,260],{},"Connector."," A secure link from the AI product to a live system. Read-only is a control. A production write login is a different risk class.",[232,263,264,267],{},[178,265,266],{},"Fail-closed."," Missing approval means nothing happens. Fail-open means the change goes through unless someone happens to stop it.",[232,269,270,273],{},[178,271,272],{},"Least privilege."," The connected identity should not be able to edit every object “because setup was easier.” Application-level quotes do not shrink a superuser token.",[232,275,276,279],{},[178,277,278],{},"Rollback."," Sometimes possible for a field; often impossible for a sent message. Rollback is not a substitute for a gate.",[174,281,282,283,288,289,293],{},"The ",[196,284,287],{"href":285,"rel":286},"https://www.nist.gov/cyberframework",[200],"NIST Cybersecurity Framework"," is useful vocabulary here — identify, protect, detect, respond, recover — but it does not, by itself, quote a Salesforce payload. ",[196,290,292],{"href":291},"what-is-ai-governance","AI governance"," is the broader programme. Write-back governance is the write subset.",[224,295,297],{"id":296},"why-you-should-care","Why you should care",[174,299,300,301,304],{},"Most enterprise software already has write controls: CRM validation, ERP posting periods, maker-checker in banking. Generative AI added a new writer that does not respect those cultures unless the ",[178,302,303],{},"runtime"," is bound to them.",[174,306,307],{},"It affects you if AI can:",[229,309,310,313,316,319],{},[232,311,312],{},"change revenue, pipeline, or customer records",[232,314,315],{},"post journals",[232,317,318],{},"send a customer a message that asserts a term or a price",[232,320,321],{},"bulk-update hundreds of rows",[174,323,324],{},"Industry maturity, in plain steps:",[326,327,328,339,345,351],"ol",{},[232,329,330,333,334,338],{},[178,331,332],{},"Copy-paste."," A human types model output into the live system. Unlogged as AI. See ",[196,335,337],{"href":336},"what-is-shadow-ai","shadow AI",".",[232,340,341,344],{},[178,342,343],{},"Tools plus manners."," The model has an “update opportunity” button. Instructions say to confirm. Haste and bugs bypass.",[232,346,347,350],{},[178,348,349],{},"Admin toggles."," “Allow writes” per user. No preview of the exact change.",[232,352,353,356],{},[178,354,355],{},"Quoted, named, fail-closed."," The product shows the change, binds the signer’s identity, records the outcome.",[174,358,359],{},"Only (4) is write-back governance in the sense auditors mean.",[174,361,362,363,366],{},"Salesforce validation will stop some nonsense. It will not record that an ",[204,364,365],{},"AI"," proposed the change, which playbook was cited, or that finance rejected an earlier payload.",[368,369,371],"h3",{"id":370},"how-to-turn-it-on-without-starting-in-production","How to turn it on without starting in production",[174,373,374,375,378],{},"Start ",[178,376,377],{},"read-only",". Prove retrieval and drafts. Count how often humans would have written — and how often the draft contains something you would not file.",[174,380,381,382,385],{},"Enable writes ",[178,383,384],{},"per job and per object type",". A next-step note is not Amount. A journal is not Slack.",[174,387,388],{},"Always show the payload. Rejects are success: a stored rejection proves the gate. Never hide bulk in a single “approve 200 records” with no visible set.",[174,390,391],{},"Rollback is not a substitute. Some writes are messages you cannot unsend.",[174,393,394],{},"Do not give the agent a full production key “because the proof of value was read-only” and promise to add gates later. Later is when the first bad write ships.",[368,396,398],{"id":397},"what-changes-by-role","What changes by role",[174,400,401,404,405,338],{},[178,402,403],{},"Finance."," Journals and material fields need the owner of the analogue posting, a field-level quote, and a chain that shows the wiki version cited. A champion who does not own the ledger will rubber-stamp. Spend caps stop looping proposers; they do not replace the signer. See ",[196,406,408],{"href":407},"what-is-ai-token-economics","What is AI token economics",[174,410,411,414,415,418],{},[178,412,413],{},"Legal."," Customer messages, terms, and anything that could become a commitment. Air Canada is the caution. Legal should also treat copy-paste from a consumer model as a write that bypassed the programme. ",[196,416,206],{"href":198,"rel":417},[200]," is fluent fiction entering a record — the CRM analogue is a next-step that never happened, or a clause the company does not offer.",[174,420,421,424,425,429],{},[178,422,423],{},"Operations."," Object-class rollout, visible bulk, human wait as a ",[196,426,428],{"href":427},"what-is-an-agentic-workflow","workflow"," step. Ops should measure time-to-approved-write and reject rate, and should refuse tenant-wide write toggles.",[174,431,432,435],{},[178,433,434],{},"Go-to-market."," Friction versus incident. GTM should get fast quotes on low-radius fields first, not a weekend cleanup agent. Slack is not “safe chat”; it is still a write to a system people treat as official.",[174,437,438,441,442,445,446,451,452,456],{},[178,439,440],{},"Security."," Jailbreaks should not execute. Combine least-privilege identity ",[178,443,444],{},"and"," application-level quotes. The ",[196,447,450],{"href":448,"rel":449},"https://genai.owasp.org/llm-top-10/",[200],"OWASP Top 10 for LLM applications"," is about requesting bad actions; the gate is about refusing to run them. ",[196,453,455],{"href":454},"what-is-model-context-protocol","MCP"," will happily pass a write; it will not implement fail-closed.",[368,458,460],{"id":459},"what-people-get-wrong","What people get wrong",[174,462,463,466],{},[178,464,465],{},"Salesforce permissions as sufficient."," Necessary. If the connected user can edit all objects, the agent inherits that blast radius even with quotes.",[174,468,469,472],{},[178,470,471],{},"Prompt manners."," “Please ask first” is not fail-closed.",[174,474,475,478],{},[178,476,477],{},"Admin allow-writes."," No payload, no named signer, no record of rejects.",[174,480,481,484],{},[178,482,483],{},"Bulk one-click."," A rubber stamp with radius.",[174,486,487,490],{},[178,488,489],{},"Rollback as the control."," You cannot unsend.",[174,492,493,496],{},[178,494,495],{},"Fully autonomous production writes."," Only for low-radius, reversible actions you would otherwise schedule, with logging.",[174,498,499,502,503,338],{},[178,500,501],{},"Theatre HITL."," A checkbox is not a quote. See ",[196,504,506],{"href":505},"what-is-human-in-the-loop-ai","What is human-in-the-loop AI",[174,508,509,510,514],{},"Good looks like: connectors default to read-only; writes opt-in per job and object; field-level quotes; named identity; model cannot waive; rejects stored on the ",[196,511,513],{"href":512},"what-is-a-lifecycle-graph","lifecycle graph","; least-privilege tokens. Failure looks like a production key issued after a read-only demo.",[174,516,517,518,522],{},"This is a core job of an ",[196,519,521],{"href":520},"what-is-an-enterprise-ai-operating-system","enterprise AI operating system",": I/O control, not chat with an API on the side.",[224,524,526],{"id":525},"how-this-shows-up-in-nimbus","How this shows up in Nimbus",[174,528,529,530,532],{},"Connectors default to ",[178,531,377],{},". Write-back is opt-in. The UI quotes the intended change at the field or line level. Humans sign with their identity. The model cannot waive the gate. Missing approval is fail-closed: nothing happens.",[174,534,282,535,537],{},[196,536,23],{"href":512}," stores the quote, the decision, the execution, and errors. Agent teams can draft. They cannot release.",[174,539,540,541,543,544,338],{},"See ",[196,542,39],{"href":40}," and ",[196,545,50],{"href":51},[224,547,549],{"id":548},"questions-people-actually-ask","Questions people actually ask",[368,551,553],{"id":552},"isnt-this-just-permissions-on-the-salesforce-user","Isn’t this just permissions on the Salesforce user?",[174,555,556,557,559],{},"Permissions are necessary. If the connected user can edit all objects, the agent inherits that blast radius even with quotes. Combine least-privilege identity ",[178,558,444],{}," application-level quotes.",[368,561,563],{"id":562},"can-we-write-back-to-slack-but-not-crm","Can we write back to Slack but not CRM?",[174,565,566],{},"Yes. Different systems, different bars. Do not treat “chat” as inherently safe.",[368,568,570],{"id":569},"does-this-slow-revenue-teams","Does this slow revenue teams?",[174,572,573],{},"It slows unreviewed mutation and speeds reviewed mutation relative to email-and-hope. Measure time-to-approved-write, not time-to-first-answer.",[368,575,577],{"id":576},"can-a-jailbreak-bypass-the-gate","Can a jailbreak bypass the gate?",[174,579,580,581,584,585,588],{},"It can trick the model into ",[204,582,583],{},"requesting"," a bad write. It should not be able to ",[204,586,587],{},"execute"," without a quote and a signer.",[368,590,592],{"id":591},"what-about-fully-autonomous-writes","What about fully autonomous writes?",[174,594,595],{},"Only for low-radius, reversible actions you would otherwise schedule, with logging. If you would not let a scheduled job do it, do not let an agent do it unattended.",[368,597,599],{"id":598},"how-is-copy-paste-different-from-a-connector-write","How is copy-paste different from a connector write?",[174,601,602,603,606],{},"The live system still changes. Copy-paste is usually unlogged as AI and often happens on ",[196,604,605],{"href":336},"shadow"," tools. It is write-back without governance.",[368,608,610],{"id":609},"why-start-read-only","Why start read-only?",[174,612,613],{},"Because you need a baseline of draft quality and a count of how often a human would have written. Turning on writes on day one teaches the organisation to skip the quote.",[368,615,617],{"id":616},"is-a-next-step-note-the-same-as-amount","Is a next-step note the same as Amount?",[174,619,620],{},"No. Enable writes per object type. Low-radius, reversible fields can come first. Money and contractual language should not piggy-back on a note permission.",[368,622,624],{"id":623},"do-rejects-matter","Do rejects matter?",[174,626,627],{},"Yes. A stored rejection proves the gate and teaches the playbook. A six-month zero reject rate is a finding.",[368,629,631],{"id":630},"can-mcp-or-a-plugin-be-the-write-path","Can MCP or a plugin be the write path?",[174,633,634,635,338],{},"They can be wiring. They are not the gate. See ",[196,636,637],{"href":454},"What is Model Context Protocol",[368,639,641],{"id":640},"how-does-this-relate-to-the-eu-ai-act","How does this relate to the EU AI Act?",[174,643,644,645,338],{},"Effective oversight, for higher-risk systems, includes the ability to interrupt. A fail-closed named signer is that instinct for operational writes. It is not, by itself, “Act compliant.” See ",[196,646,649],{"href":647,"rel":648},"https://eur-lex.europa.eu/eli/reg/2024/1689/oj",[200],"EU AI Act",[368,651,653],{"id":652},"what-should-auditors-see","What should auditors see?",[174,655,656],{},"The payload the signer saw, the identity, the timestamp, the playbook version cited, and whether the live system accepted or rejected the change — on a chain, not in a screenshot.",[224,658,660],{"id":659},"related-reading","Related reading",[174,662,663,543,666,338],{},[196,664,665],{"href":336},"What is shadow AI",[196,667,668],{"href":520},"What is an enterprise AI operating system",[224,670,672],{"id":671},"sources","Sources",[229,674,675,681,686,692,698,703],{},[232,676,677],{},[196,678,680],{"href":198,"rel":679},[200],"Reuters, New York lawyers sanctioned for ChatGPT fake cases",[232,682,683],{},[196,684,287],{"href":285,"rel":685},[200],[232,687,688],{},[196,689,691],{"href":213,"rel":690},[200],"CBC, Air Canada chatbot lawsuit",[232,693,694],{},[196,695,697],{"href":219,"rel":696},[200],"Civil Resolution Tribunal, Moffatt v. Air Canada",[232,699,700],{},[196,701,450],{"href":448,"rel":702},[200],[232,704,705],{},[196,706,708],{"href":647,"rel":707},[200],"EU AI Act (Regulation 2024/1689)",{"title":155,"searchDepth":156,"depth":156,"links":710},[711,712,718,719,733,734],{"id":226,"depth":156,"text":227},{"id":296,"depth":156,"text":297,"children":713},[714,716,717],{"id":370,"depth":715,"text":371},3,{"id":397,"depth":715,"text":398},{"id":459,"depth":715,"text":460},{"id":525,"depth":156,"text":526},{"id":548,"depth":156,"text":549,"children":720},[721,722,723,724,725,726,727,728,729,730,731,732],{"id":552,"depth":715,"text":553},{"id":562,"depth":715,"text":563},{"id":569,"depth":715,"text":570},{"id":576,"depth":715,"text":577},{"id":591,"depth":715,"text":592},{"id":598,"depth":715,"text":599},{"id":609,"depth":715,"text":610},{"id":616,"depth":715,"text":617},{"id":623,"depth":715,"text":624},{"id":630,"depth":715,"text":631},{"id":640,"depth":715,"text":641},{"id":652,"depth":715,"text":653},{"id":659,"depth":156,"text":660},{"id":671,"depth":156,"text":672},"2026-08-17","Write-back governance is the rule that an AI may not change a live business system until a named person has seen the exact change and signed it — and if they have not, nothing happens.","/blog/what-is-write-back-governance",{"title":165,"description":736},"explainer","blog/what-is-write-back-governance",[739,742,743,744],"write-back","governance","connectors","NpLHSvl19Ztum-YfmyaIPbb2qPi9_oe0byoAys85nK0",{"hero":747,"id":749,"title":750,"archived":149,"authors":150,"badge":150,"body":751,"date":150,"department":150,"description":755,"extension":158,"eyebrow":756,"faqHeader":150,"faqs":150,"footerBand":757,"headline":150,"image":150,"industry":150,"jobType":150,"listed":149,"location":150,"navigation":115,"openRoles":150,"pageLayout":150,"path":60,"relatedHeading":763,"seo":764,"series":150,"sitemap":115,"status":150,"stem":765,"subhead":150,"tags":150,"video":150,"whyJoin":150,"workplaceType":150,"__hash__":766},{"filename":748},"u2221455217_Flat_design_of_a_futuristic_minimalist_landscape__5d589295-cdea-4ea9-a262-be766881accf_1.png","content/blog/index.md","Exploring the future of intelligence.",{"type":152,"value":752,"toc":753},[],{"title":155,"searchDepth":156,"depth":156,"links":754},[],"Deep dives into pre-cognitive intelligence, sentient enterprises, and the evolving landscape of AI-driven business transformation.","Latest Research",{"headline":758,"description":759,"primaryLabel":760,"primaryTo":761,"secondaryLabel":762,"secondaryTo":12},"Stay at the frontier.","Subscribe for product updates and new insights.","Subscribe","/newsletter","Explore the platform","More research",{"title":750,"description":755},"blog/index","eK1RCXdDW8nfLSyKRXGB1mJm9FAmhAO6GWXwNKOMNVE",[150,768],{"id":769,"title":770,"archived":149,"authors":771,"badge":773,"body":774,"date":735,"department":150,"description":1205,"extension":158,"eyebrow":150,"faqHeader":150,"faqs":150,"footerBand":150,"headline":150,"image":150,"industry":150,"jobType":150,"listed":149,"location":150,"navigation":115,"openRoles":150,"pageLayout":150,"path":1206,"relatedHeading":150,"seo":1207,"series":739,"sitemap":115,"status":150,"stem":1208,"subhead":150,"tags":1209,"video":150,"whyJoin":150,"workplaceType":150,"__hash__":1212},"content/blog/what-is-shadow-ai.md","What is Shadow AI",[772],{"name":168,"to":120},{"label":170},{"type":152,"value":775,"toc":1180},[776,779,782,789,797,800,802,856,864,866,869,919,922,926,929,932,942,944,949,958,963,968,973,975,981,987,993,999,1005,1013,1021,1023,1029,1032,1038,1040,1044,1050,1054,1057,1061,1068,1072,1075,1079,1082,1086,1089,1093,1103,1107,1114,1118,1121,1125,1131,1135,1138,1142,1145,1147,1154,1156],[174,777,778],{},"Shadow AI is employees using personal ChatGPT, Claude, Gemini, or similar tools for work because the official company tool is too slow, too locked down, or missing.",[174,780,781],{},"The work is real. The risk is off the books. Security often hears about it first as an incident.",[174,783,784,785,788],{},"It is the AI-era cousin of ",[178,786,787],{},"shadow IT",": unsanctioned software people adopt because it helps them finish the job. The pattern is older than ChatGPT — personal Dropbox, unsanctioned notebooks, Excel macros that became load-bearing. Generative AI sped it up because the tools are excellent, cheap, and one paste away from a customer list.",[174,790,791,796],{},[196,792,795],{"href":793,"rel":794},"https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls",[200],"IBM’s 2025 Cost of a Data Breach research"," found that 20% of organisations reported security incidents involving shadow AI, and that organisations with high levels of it paid $670,000 more per breach. Sixty-three percent lacked AI governance policies.",[174,798,799],{},"Shame does not fix those numbers. Substitution does. People paste work into personal accounts because the deadline is tonight and the official programme is a waitlist. If the approved tool cannot see Salesforce, they will export a spreadsheet. If the approved tool is ten times slower than paste, shadow wins.",[224,801,227],{"id":226},[229,803,804,814,824,830,836,842,850],{},[232,805,806,809,810,813],{},[178,807,808],{},"Shadow IT."," Unsanctioned systems. Shadow AI is often unsanctioned ",[204,811,812],{},"generation"," on a sanctioned laptop — a personal account, not a new product install. At work, the browser is allowed; the tenant is not yours.",[232,815,816,819,820,823],{},[178,817,818],{},"Sanctioned tool."," The company’s official AI, with company login and a vendor agreement. At work, ChatGPT Enterprise on the company tenant can be sanctioned and still be ",[178,821,822],{},"ungoverned for writes"," if people copy output into CRM.",[232,825,826,829],{},[178,827,828],{},"Data leakage."," Prompts become logs at a vendor you have no processing agreement with. At work, a customer list in a consumer chat is a processing event you cannot inventory.",[232,831,832,835],{},[178,833,834],{},"Acceptable-use policy."," A PDF. Necessary. Not a substitute for a tool people can actually use.",[232,837,838,841],{},[178,839,840],{},"DLP / CASB."," Network or cloud tools that watch paste-out and unsanctioned apps. Useful. They do not quote a CRM change or bind a named signer.",[232,843,844,847,848,338],{},[178,845,846],{},"Personal API key."," A pass-through that looks like engineering hygiene and is often shadow AI with a credit card. See ",[196,849,408],{"href":407},[232,851,852,855],{},[178,853,854],{},"Pressure valve."," A logged sandbox with fake data and no production writes. Not shadow. A way to experiment without a customer list.",[174,857,858,863],{},[196,859,862],{"href":860,"rel":861},"https://www.enisa.europa.eu/publications/enisa-threat-landscape-2025",[200],"ENISA’s Threat Landscape 2025"," notes fake AI-tool sites and malware posing as AI installers. People hunting for “a free assistant” are the audience. Blocking the official vendors without a substitute trains that hunt.",[224,865,297],{"id":296},[174,867,868],{},"That can mean:",[229,870,871,883,893,903,913],{},[232,872,873,876,877,882],{},[178,874,875],{},"Customer or internal data sitting in a consumer vendor’s logs."," Legal later asks which model saw it. Nobody can say. ",[196,878,881],{"href":879,"rel":880},"https://eur-lex.europa.eu/eli/reg/2016/679/oj",[200],"GDPR"," does not pause because the employee used a personal account.",[232,884,885,888,889,892],{},[178,886,887],{},"Changes with no record."," Someone types model output into CRM. No approver of record. That is ungoverned ",[196,890,742],{"href":891},"what-is-write-back-governance"," with extra steps.",[232,894,895,898,899,338],{},[178,896,897],{},"Two versions of policy."," The official playbook says one thing. A shadow chat invented another. See ",[196,900,902],{"href":901},"what-is-a-company-wiki-for-ai-agents","What is a company wiki for AI agents",[232,904,905,908,909,338],{},[178,906,907],{},"Institutional amnesia."," The reasoning lived in a thread the company cannot query. See ",[196,910,912],{"href":911},"what-is-institutional-memory-in-enterprise-ai","What is institutional memory in enterprise AI",[232,914,915,918],{},[178,916,917],{},"A wider attack surface."," Fake installer sites, prompt leakage, and keys in plugins.",[174,920,921],{},"Blocking websites without offering a sanctioned path does not end shadow AI. It trains people to use personal phones.",[368,923,925],{"id":924},"what-actually-reduces-it","What actually reduces it",[174,927,928],{},"Find the jobs people are already doing in personal chats: drafting, summarising, extracting tables, writing the email. Put those jobs on an official path that can see the right files without a paste.",[174,930,931],{},"Read-only links to live systems in an approved product are how you stop the spreadsheet. Make the official path not much slower than paste. The honest metric is time to finish the job.",[174,933,934,935,938,939,941],{},"Perimeter blocking can tighten ",[204,936,937],{},"after"," a real path exists — not before. ",[196,940,292],{"href":291}," that is only a block list is guidance with extra steps.",[368,943,398],{"id":397},[174,945,946,948],{},[178,947,403],{}," Shadow spend hides on personal cards and departmental tools. Shadow output typed into the ledger has no trail. Finance should want a sanctioned path with quotes and caps, not a ban that moves the bill onto expenses.",[174,950,951,953,954,957],{},[178,952,413],{}," Processing without an agreement, invented customer commitments, and no inventory of what left the tenant. Air Canada’s chatbot was official and still made a false commitment — ",[196,955,215],{"href":213,"rel":956},[200],". Shadow tools add the same class of fiction with even less control. Legal should not allow “non-sensitive only” personal accounts; employees are bad at classifying.",[174,959,960,962],{},[178,961,423],{}," Deadline pressure is the demand signal. Ops should treat missing connectors and waitlists as root causes, and should offer sandboxes so experimentation does not need production data.",[174,964,965,967],{},[178,966,434],{}," Fastest to shadow, because the consumer tools are excellent at email and decks. GTM needs read-only CRM in the official path or they will export. They also copy invented pricing into the opportunity — a write-back problem dressed as productivity.",[174,969,970,972],{},[178,971,440],{}," Detection (surveys, DLP, key scanning) plus substitution. Punishment first yields dishonest surveys. IBM’s uplift in breach cost is the board-level argument; ENISA’s fake-tool landscape is the practical one. A secure web gateway is not a named signer.",[368,974,460],{"id":459},[174,976,977,980],{},[178,978,979],{},"Blocking as strategy."," Phones exist.",[174,982,983,986],{},[178,984,985],{},"Sanctioned equals governed."," Company ChatGPT can still be copy-paste into Salesforce.",[174,988,989,992],{},[178,990,991],{},"Allowing personal accounts for “non-sensitive” work."," Classification fails under deadline.",[174,994,995,998],{},[178,996,997],{},"Shame."," Drives better hiding, not better behaviour.",[174,1000,1001,1004],{},[178,1002,1003],{},"Assuming shadow is a people problem."," It is usually a missing-path problem: no connectors, no speed, no permission to try.",[174,1006,1007,1008,1012],{},"Good looks like: self-service ",[196,1009,1011],{"href":1010},"what-is-an-ai-workstream","workstreams",", wiki, read-only connectors, a named signer on writes, time-to-job close to paste, perimeter controls after substitution, sandboxes with fake data. Failure looks like a blocked URL, a PDF, and a personal Claude project full of customers.",[174,1014,1015,1020],{},[196,1016,1019],{"href":1017,"rel":1018},"https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/",[200],"ICO guidance on AI and data protection"," still applies when the employee is the one pasting. Lawful basis and purpose do not wait for an official rollout. That is why substitution is a legal control as well as a security one: the unofficial path is still processing.",[224,1022,526],{"id":525},[174,1024,1025,1026,1028],{},"Nimbus is built so the legitimate path is the easy path: operators open ",[196,1027,1011],{"href":1010}," themselves, use approved playbooks and read-only connectors, and only write to live systems after a named person signs.",[174,1030,1031],{},"Nimbus does not “detect shadow AI” the way a network tool that watches cloud apps would. Those perimeter tools still matter. The product bet is gravitational: if governed work is live quickly, shadow has less to do.",[174,1033,540,1034,543,1036,338],{},[196,1035,39],{"href":40},[196,1037,31],{"href":32},[224,1039,549],{"id":548},[368,1041,1043],{"id":1042},"is-using-chatgpt-enterprise-still-shadow-ai","Is using ChatGPT Enterprise still shadow AI?",[174,1045,1046,1047,1049],{},"If it is the organisation’s tenant, with company login, a processing agreement, and a defined use policy, it is sanctioned — not shadow. It can still be ",[178,1048,822],{}," (people copy output into CRM). Sanctioned is not the same as sufficient.",[368,1051,1053],{"id":1052},"does-blocking-openai-at-the-office-network-solve-it","Does blocking OpenAI at the office network solve it?",[174,1055,1056],{},"It reduces one channel. It does not stop phones, home networks, or other vendors. Without a substitute, it also reduces productivity.",[368,1058,1060],{"id":1059},"can-we-allow-personal-accounts-for-non-sensitive-work","Can we allow personal accounts for “non-sensitive” work?",[174,1062,1063,1064,1067],{},"Employees are bad at classifying. If you allow it, assume leakage of whatever they ",[204,1065,1066],{},"think"," is non-sensitive.",[368,1069,1071],{"id":1070},"how-do-we-find-existing-shadow-ai","How do we find existing shadow AI?",[174,1073,1074],{},"Anonymous surveys, credit-card review, data-loss monitoring, scanning for personal API keys, and talking to the teams under deadline pressure. Do not start with punishment if you want honest answers.",[368,1076,1078],{"id":1077},"why-do-people-prefer-the-unofficial-tools","Why do people prefer the unofficial tools?",[174,1080,1081],{},"Speed, quality, missing connectors in the official tool, and fear of “the AI team.” Treat those as requirements, not as moral failure.",[368,1083,1085],{"id":1084},"is-a-logged-sandbox-shadow-ai","Is a logged sandbox shadow AI?",[174,1087,1088],{},"No. Fake data, no production writes, company login: that is a pressure valve. Production customer lists in a personal account are not.",[368,1090,1092],{"id":1091},"how-is-this-different-from-shadow-it","How is this different from shadow IT?",[174,1094,1095,1096,1099,1100,1102],{},"Shadow IT is often an unsanctioned ",[204,1097,1098],{},"system",". Shadow AI is often unsanctioned ",[204,1101,812],{}," on a laptop you issued. Your asset inventory will look clean while the prompts leave.",[368,1104,1106],{"id":1105},"what-does-ibms-research-actually-say-here","What does IBM’s research actually say here?",[174,1108,1109,1110,338],{},"IBM reported shadow-AI incidents, higher average breach cost where shadow AI was high, and a large share of organisations lacking AI governance policies. Use it as evidence that this is a control topic, not a manners topic. Read the ",[196,1111,1113],{"href":793,"rel":1112},[200],"newsroom summary",[368,1115,1117],{"id":1116},"will-a-better-acceptable-use-policy-be-enough","Will a better acceptable-use policy be enough?",[174,1119,1120],{},"Write it. Then put the same rules in a product people can finish the job with. PDFs do not see Salesforce.",[368,1122,1124],{"id":1123},"how-do-writes-sneak-in","How do writes sneak in?",[174,1126,1127,1128,338],{},"The model never calls Salesforce. A human pastes the answer. That is still a change to a live system with no quote and no named signer. See ",[196,1129,1130],{"href":891},"What is write-back governance",[368,1132,1134],{"id":1133},"should-we-ban-plugins-and-personal-api-keys","Should we ban plugins and personal API keys?",[174,1136,1137],{},"Treat them as unsanctioned processing until they sit on a company path with a ceiling. Keys in wikis are an unmetered utility and a credential incident.",[368,1139,1141],{"id":1140},"what-is-the-first-sanctioned-path-worth-shipping","What is the first sanctioned path worth shipping?",[174,1143,1144],{},"Read-only connectors on the jobs people already paste — email, extract, summarise — plus a wiki they can cite. Writes come later, fail-closed. Speed matters more than a perfect platform launch.",[224,1146,660],{"id":659},[174,1148,1149,543,1152,338],{},[196,1150,1151],{"href":291},"What is AI governance",[196,1153,1130],{"href":891},[224,1155,672],{"id":671},[229,1157,1158,1164,1170,1175],{},[232,1159,1160],{},[196,1161,1163],{"href":793,"rel":1162},[200],"IBM newsroom, Cost of a Data Breach 2025",[232,1165,1166],{},[196,1167,1169],{"href":860,"rel":1168},[200],"ENISA Threat Landscape 2025",[232,1171,1172],{},[196,1173,881],{"href":879,"rel":1174},[200],[232,1176,1177],{},[196,1178,691],{"href":213,"rel":1179},[200],{"title":155,"searchDepth":156,"depth":156,"links":1181},[1182,1183,1188,1189,1203,1204],{"id":226,"depth":156,"text":227},{"id":296,"depth":156,"text":297,"children":1184},[1185,1186,1187],{"id":924,"depth":715,"text":925},{"id":397,"depth":715,"text":398},{"id":459,"depth":715,"text":460},{"id":525,"depth":156,"text":526},{"id":548,"depth":156,"text":549,"children":1190},[1191,1192,1193,1194,1195,1196,1197,1198,1199,1200,1201,1202],{"id":1042,"depth":715,"text":1043},{"id":1052,"depth":715,"text":1053},{"id":1059,"depth":715,"text":1060},{"id":1070,"depth":715,"text":1071},{"id":1077,"depth":715,"text":1078},{"id":1084,"depth":715,"text":1085},{"id":1091,"depth":715,"text":1092},{"id":1105,"depth":715,"text":1106},{"id":1116,"depth":715,"text":1117},{"id":1123,"depth":715,"text":1124},{"id":1133,"depth":715,"text":1134},{"id":1140,"depth":715,"text":1141},{"id":659,"depth":156,"text":660},{"id":671,"depth":156,"text":672},"Shadow AI is people using personal ChatGPT or similar for work because the official tool is too slow or missing — which leaks data and leaves no record of what changed.","/blog/what-is-shadow-ai",{"title":770,"description":1205},"blog/what-is-shadow-ai",[739,1210,743,1211],"shadow-ai","security","KN9Y86Ep7MHgpyV42_OuagUFVF0e4uq-AzZGLvkQLX4",{"enabled":149,"message":1214,"linkLabel":78,"linkHref":79,"id":1215,"title":1216,"archived":149,"authors":150,"badge":150,"body":1217,"date":150,"department":150,"description":155,"extension":158,"eyebrow":150,"faqHeader":150,"faqs":150,"footerBand":150,"headline":150,"image":150,"industry":150,"jobType":150,"listed":149,"location":150,"navigation":115,"openRoles":150,"pageLayout":150,"path":1221,"relatedHeading":150,"seo":1222,"series":150,"sitemap":115,"status":150,"stem":1223,"subhead":150,"tags":150,"video":150,"whyJoin":150,"workplaceType":150,"__hash__":1224},"We're hiring! Join the team building the Sentient Enterprise.","content/shared/hiring.md","Hiring banner",{"type":152,"value":1218,"toc":1219},[],{"title":155,"searchDepth":156,"depth":156,"links":1220},[],"/shared/hiring",{"title":1216,"description":155},"shared/hiring","-6bioYD7lKYokGUVU3ff4hHTvB-sDyOMuCptKHnojfk",{"fold":1226,"id":1230,"title":1231,"archived":149,"authors":150,"badge":150,"body":1232,"date":150,"department":150,"description":155,"extension":158,"eyebrow":150,"faqHeader":150,"faqs":150,"footerBand":1236,"headline":150,"image":150,"industry":150,"jobType":150,"listed":149,"location":150,"navigation":115,"openRoles":150,"pageLayout":150,"path":1240,"relatedHeading":150,"seo":1241,"series":150,"sitemap":115,"status":150,"stem":1242,"subhead":150,"tags":150,"video":150,"whyJoin":150,"workplaceType":150,"__hash__":1243},{"headline":1227,"description":1228,"primaryLabel":8,"primaryTo":1229,"secondaryLabel":762,"secondaryTo":12},"Run frontier AI your business actually owns.","Governed agent swarms, 2,000+ integrations, and a knowledge graph that stays inside your walls. Free 7-day trial.","/checkout","content/shared/cta.md","Site CTAs",{"type":152,"value":1233,"toc":1234},[],{"title":155,"searchDepth":156,"depth":156,"links":1235},[],{"headline":1237,"description":1238,"primaryLabel":8,"primaryTo":1229,"secondaryLabel":1239,"secondaryTo":84},"See what governed AI looks like on your stack.","Connect your tools, run a workstream, and keep every decision on your ledger - free for 7 days.","Talk to our team","/shared/cta",{"title":1231,"description":155},"shared/cta","YHK6Fb8AvCPR1zZq7R_xiXUG0hwhP5UxHA8Ix52JQp4",1787194075058]