A practical guide for finance and ops leaders on shadow AI, prompt injection, access controls, and the simple governance moves that lower AI risk.
This piece is adapted from an Operators Guild Focus Session on AI risk and governance, featuring Korey Mercier of Herding Wolves and Bryan Kaplan, CI&SO at Juvare, and shaped by a live discussion among operators who are being asked to adopt AI fast while keeping company data safe. Focus Sessions are small-group, member-only conversations where operators work through real problems with practitioners who've been there. If you want access to sessions like this, including the recordings and the community behind them, you can apply to join OG.
Most operators are feeling two kinds of pressure at once. Leadership wants AI everywhere: automate what you can, do more with the team you have, hold off on new hires. At the same time, the headlines are full of data leaks, rogue agents, and tools doing things nobody approved.
So the useful question for an operator is a practical one. AI is already in use across your company. How do you make that use safe, visible, and owned?
Start by finding out what's already in use
You can't govern what you can't see, and most companies are using far more AI than leadership realizes. One survey of a hospital system found that about a fifth of employees had pasted patient data into personal AI tools because the approved option was too slow or unavailable. These were people who knew the rules.
An audit is the first step, and it works best when it feels safe:
- Run an informal survey of which tools people use and what they use them for.
- Make it clear nobody gets in trouble for sharing what they're doing today.
- Check expense reports for small recurring AI subscriptions that slipped under the radar.
- Talk to marketing early, since that team is often furthest ahead on AI tools.
Some companies that run this exercise find 40 or more tools in use, and even that list is usually incomplete. The audit does more than find risk. It shows you where AI is already earning its keep. If half your finance team is paying for its own AI subscription to reconcile statements faster, that's a use case the company should support with an approved tool.
Use what you learn to decide:
- Which use cases are valuable enough to bring onto company accounts with enterprise terms, logging, and the right access controls.
- Which tools to approve, consolidate, or retire, based on what people already rely on.
- Where each team needs its own rules, since what's safe for marketing copy may not be safe for payroll data.
- Where training will matter most, starting with the teams handling the most sensitive data.
That turns governance into something people want to follow, because it gives them better versions of the tools they're already using.
Know which risks matter most
Once you know what's in use, sort it by where the AI lives. It usually shows up in three places:
- AI tools your team uses directly, like ChatGPT, Claude, or Gemini.
- AI built into software you already pay for, like the assistants now inside Salesforce, Microsoft 365, Grammarly, Figma, and Canva.
- AI inside the products you sell, if you're a software company.
The second group is the easiest to miss, because nobody on your team went out and chose it. Across all three, the same three risks come up again and again.
AI features that turn on by default. Vendors are adding AI to tools you approved years ago, often switched on automatically and sometimes added to your bill. Your original vendor review didn't account for those features, so the risk you signed off on has changed without anyone telling you.
Prompt injection. This is when someone hides instructions inside content an AI reads, like an email, a web page, or a shared file. LLMs can't reliably tell instructions apart from data, so an assistant summarizing your inbox could follow a hidden line telling it to forward files somewhere they shouldn't go.
A bigger blast radius than you expect. Blast radius is how much damage one mistake or attack can do. Some AI systems can see more than the person using them is allowed to see. Every system you connect, like your CRM, ERP, project tools, or file storage, widens what a single successful attack can reach.
Build guardrails that hold up
System instructions telling a model what not to do are useful, but they're the thin top layer. Models can drop earlier instructions as a conversation grows, or decide a newer instruction matters more. Good protection is layered, the same way cybersecurity has always worked.
A few practical ways to address this:
- Define what an agent can't do through real access controls, beyond what it's told not to do.
- Keep AI away from personal inboxes. Whoever controls your email can reset the password on nearly every account you have.
- Use service accounts, role inboxes, or a separate domain for automated work like registrations and subscriptions. This keeps automation off human identities and makes every agent action traceable.
- Give those service accounts narrower access than a person with human judgment would have.
Set up governance a lean team can run
Every company needs AI governance, whether it's a two-person startup or a 10,000-person enterprise. It'll look different at each size, and it should grow as the company scales. Two things matter most: be intentional, and name an owner.
For a Series A company with no security team, a few moves go a long way:
- Move people onto a paid team plan that lets you control which users have access.
- Turn off model training, so your data isn't used to train future models.
- Publish a short list of approved tools and a simple way to request new ones.
- Pair every rule with training, the same way teams learned to spot phishing links.
Lower spend doesn't mean lower risk. Teams spending little on AI are often the ones paying the least attention to it. And banning AI outright tends to backfire, since people keep using it and stop telling you.
Look for exposure outside IT
Some of the biggest AI risks sit in legal, HR, and finance.
- Insurance. Many cyber liability policies now limit or exclude incidents involving AI. For a smaller company, finding that out after an incident could end the business.
- Hiring. Some states may treat AI tools used in hiring as discriminatory unless they've had an independent bias evaluation.
- Copyright. Content generated by an LLM may not be protectable, which matters for things like a logo you plan to trademark.
- Data retention. Even on paid plans, providers can keep conversation records for a period of time. Answering a "how's it going?" feedback prompt can give permission to keep a transcript.
- Open weight models. These can be a smart, lower-cost choice when you download them from a trusted source and run them on infrastructure you control. Calling them through hosted APIs in other countries is a different risk profile.
A good privacy attorney is worth finding early, since the case law here is still thin.
Make reporting easy
When something goes wrong, speed matters. Disclosure windows after a data exposure can be short, depending on your industry and the data involved.
- Route AI incidents through channels people already use, like your compliance inbox, ticketing system, or HR partner.
- Avoid creating a separate process people have to remember.
- Tell everyone where to report, and make it low friction.
Join the conversations operators are having now
AI governance is moving fast, and most operators are building their approach as they go. OG members work through problems like this together in small-group Focus Sessions, with practitioners who are solving them in real time. If you want access to sessions like this, including the recordings and the community behind them, you can apply to join OG.