# Shadow AI governance: from unapproved tools to controlled use An employee pastes customer information into a personal AI account. A developer connects a coding agent to an internal repository. A team adopts an AI browser extension without a security review. These are practical starting points for a **shadow AI assessment**: understanding which tools people use, what those tools can reach and who owns the risk. NitronEdge works with [SOAISEC Labs](/solutions/agentic-ai-security/soaisec/) to help customers explore this use case. The partner's [SentraGuard GCC showcase](https://shadowai-gcc.soaisec.com/gcc) identifies NitronEdge as its value-added solution seller. It includes an interactive policy preview, a video and supporting resources. ## What the SentraGuard showcase covers SOAISEC describes discovery across browsers, development environments, APIs and endpoints, including personal accounts, agents and MCP servers. Its policy model offers **allow, coach, redact and block** decisions. The campaign also describes evidence exports and SaaS, private-cloud, on-premises and air-gapped deployment options. These are vendor-described capabilities to validate against your environment during scoping. ## Three workflows to discuss with your security team - **Banking:** a service employee wants to summarise a customer complaint. Identify the approved assistant, decide which customer fields must be removed, and define an exception path before testing. See our [banking solutions](/industries/banking/). - **Public sector:** a team wants AI assistance with internal documents. Agree document classifications, approved accounts and hosting requirements before deciding what use is permitted. Explore [public-sector solutions](/industries/public-sector/). - **Engineering:** a coding agent requests repository or tool access. Review credentials, permitted operations and approval requirements alongside the agent's own security controls. These are illustrative assessment scenarios, not customer results. ## Plan a pilot with measurable acceptance criteria The campaign proposes a one-week pilot for one business unit. Treat this as a starting schedule, subject to access, deployment readiness and agreed scope. Before starting, agree: - Which users, applications, devices and agent integrations are in scope. - What can be recorded, who can access it and how long it is retained. - Which test cases should be allowed, coached, redacted or blocked. - How false positives, user disruption and coverage gaps will be evaluated. - What evidence and operational handover are needed for a rollout decision. A product report supports a review; it does not itself establish regulatory compliance. Confirm applicable obligations and proposed controls with your compliance team. ## Explore the demo or scope your use case [Open the SOAISEC-hosted SentraGuard showcase](https://shadowai-gcc.soaisec.com/gcc), then [contact NitronEdge to discuss a shadow AI pilot](/contact/). The showcase focuses on GCC environments; suitability elsewhere needs separate scoping. Its examples are demonstrations, not measurements of your organisation. For the wider implementation journey, see our [AI security services](/services/ai-security/).