How to detect policy violations in AI-assisted work

Establish the policy boundary

Name the organization, workflow, policy version, effective date, people and systems in scope, and the owner authorized to interpret the rule. Separate legal requirements, internal policy, contractual conditions, and team guidance. They may require different reviewers and consequences.

The NIST AI RMF Core calls for transparent policies, documented responsibilities, monitoring, incident identification, response, recovery, and change management. Those outcomes support a traceable operating method, but they do not determine whether a particular act is lawful or compliant.

Translate each relevant rule into an observable control statement. “Protect confidential data” is too broad. “Do not paste customer account data into an unapproved external assistant” identifies the data, action, and system boundary. Preserve the original wording beside the operational interpretation.

Sources: [1]

Build a policy-control trace

Create one row per material rule with these fields: policy ID, source passage, operational interpretation, prohibited or required event, preventive control, detective evidence, response owner, disposition, and restoration test. Add an uncertainty field when evidence is incomplete or two rules conflict.

Use separate outcomes: no observed violation, suspected, confirmed by the authorized owner, exception approved, not applicable, and unresolved. A missing log is not evidence that the rule was followed. It is an evidence gap whose effect depends on the workflow and policy.

The NIST AI RMF Playbook offers suggested actions across govern, map, measure, and manage. Apply that lifecycle by checking whether the policy was defined, communicated, technically supported, monitored, and connected to a workable response.

Sources: [2]

Work a synthetic client-brief example

Imagine a consulting team preparing a fictional market brief. Internal policy permits an approved enterprise assistant for public sources and synthetic client details. It prohibits pasting identifiable client data into an external consumer tool and requires material claims to retain source links.

The evidence packet contains a browser history, assistant transcript, source list, draft, and tool inventory. The trace identifies three events:

The reviewer does not label P-02 a data breach. The evidence supports a possible tool-policy violation, while the data itself is synthetic. That distinction prevents an operational rule from being inflated into a legal conclusion.

The response removes the unsupported claim, restores citation checks, records the tool event, and reruns the case with an approved route. Closure requires the rendered brief to preserve material sources and the tool inventory to show only permitted systems for the exercise.

• P-01: a participant uses the approved assistant with public reports. Disposition: within the tested policy boundary.
• P-02: an unapproved consumer tool receives a synthetic account number that resembles the client format but is explicitly marked fictional. Disposition: not a confidential-data incident, but the tool-use rule still requires review.
• P-03: the final brief includes a market-size claim whose source link was removed during layout. Disposition: output-control failure requiring correction before delivery.

Test prevention, detection, and recovery

Test a blocked action, a permitted exception, a stale policy version, an unavailable log, a user with the wrong role, and a violation discovered only in the final artifact. Confirm what the system prevents, what it records, and what a person must decide.

Check policy usability. If a worker cannot identify the approved tool, find the rule, or reach the exception owner before a deadline, the control design contributes to failure. Record training, access, and escalation gaps separately from the event disposition.

Preserve proportionality. Low-impact deviations may require correction and learning; consequential events may require suspension, incident handling, or specialist review. The accountable organization sets those thresholds and follows applicable employment, privacy, security, contractual, and legal processes.

Verify closure

Closure requires evidence that the immediate issue was contained, the affected artifact was corrected, downstream copies were addressed, the control change was implemented, and a relevant test now passes. Record residual uncertainty and reopen the item if the behavior recurs.

Review patterns periodically without turning raw counts into performance rankings. More reports can reflect better detection and reporting, not worse behavior. Compare event types, evidence completeness, recurrence, and correction quality.

Two Prune can create a bounded simulation with explicit policies, tool choices, evidence traps, and a defined deliverable, then retain submitted work and available workflow evidence for human interpretation. It does not monitor production employees, determine legal violations, certify compliance, or make employment decisions. Missing evidence remains a confidence limitation.