AI Usage Policy: How to Write One That Actually Gets Followed
Blocking AI entirely can push employees toward unapproved tools, while allowing it without guardrails can leave organizations unsure of how their data is being shared. An AI usage policy helps address both risks by defining which tools employees can use, what data they can share, and when human review is required.
For that policy to work, employees need clear instructions they can follow in their everyday tasks. Technical controls should back up those instructions, helping teams use AI safely and making the rules enforceable.
This guide walks you through what an AI acceptable use policy should include, who should own it, and how to enforce it technically, including MCP connections between AI clients and business systems.
Key Takeaways
- An AI usage policy defines which AI tools employees can use, what data they can expose, and which activities require approval or human review.
- The policy should cover approved tools, data handling, MCP server access where relevant, identity, logging, and incident reporting.
- A designated policy owner maintains the policy, IT or platform engineering drafts the technical rules, security and legal review it, and an authorized executive or governance council gives final approval.
- An MCP gateway provides centralized controls for traffic routed through it; broader enforcement also needs client, endpoint, and identity controls.
- Review the policy quarterly, because AI capabilities and organizational usage patterns shift faster than annual review cycles can handle.
What Should an AI Acceptable Use Policy Include?
A useful generative AI policy covers seven areas. For each area, explain what employees are expected to do and how the organization will help them follow the rules.
1. Approved AI Tools and Clients
List every AI application your organization permits, such as Claude, ChatGPT, or Cursor. Be specific about the plan, account type, and approved uses. “AI tools” is too vague to enforce. If your company uses an enterprise workspace, note that it’s the supported environment and explain how connector approvals work within it.
Equally important: state which tools or accounts are not approved. If employees can’t use personal AI accounts for work tasks, say so explicitly. Explain when they need to review AI-generated work for accuracy, confidentiality, intellectual property concerns, or bias before using it.
2. Data Classification and Handling Rules
Define what data categories exist in your organization, such as public, internal, confidential, and regulated, and specify which categories each approved AI tool can access. The same rules should cover information pasted into a chat, uploaded in a file, or returned by a connected tool.
If your policy says personal data must not reach an AI provider, explain how you’ll filter or block it before transmission. MCP Manager offers PII filtering for requests and responses passing through its MCP gateway. Test the filters with data similar to what your teams use, because automated detection can miss sensitive information.
Sending personal data to an AI service does not automatically mean it becomes part of the model’s training. The provider may still retain it in conversation history, logs, or safety records. Check the service’s retention settings, contract, and deletion procedures. For example, Anthropic’s retention policy distinguishes between API inputs, saved conversations, and flagged content.
For organizations subject to GDPR, the right to erasure makes it important to know where personal data is stored. Requests can become harder to fulfill when copies are spread across several systems with different retention rules. Your policy should explain how you’ll handle those requests, including applicable exceptions.
3. MCP Server Access and Approval
If your teams connect AI agents to business systems through the Model Context Protocol (MCP), your policy needs to define which MCP servers are approved, who can request new ones, and what the approval process looks like.
Maintain a registry of vetted servers, with a clear request path for anything not on the list. For each server, record who owns it, which tools are approved, and what data they can access. Approving a server shouldn’t automatically give employees access to every tool it offers. Review new tools and changes to existing ones before expanding access.
4. Access Controls and Identity
Your policy should make it possible to trace an AI agent’s actions back to the person who initiated them. Use per-user identity where possible. Shared service accounts are also an option, provided you keep a documented link between each action and its initiator. For scheduled automation, record which agent ran the task and who is responsible for it.
MCP Manager supports both per-user and shared identities. A user can authenticate individually to the MCP gateway while a connected server uses an approved service account. Check that your logs identify both the initiating user and the account used to access the server.
Specify when SSO is required, how automated agents authenticate, and how access is removed when someone leaves. Include active sessions and tokens in the offboarding process.
For EU financial entities subject to the relevant DORA requirements, Articles 20 and 21 of Delegated Regulation (EU) 2024/1774 address identity and access controls, including accountability when shared accounts are used.
5. Logging and Audit Requirements
State which AI activities must be logged. Define retention periods, specify where logs are sent, and decide who can review them. Records should show who or what initiated an action, which server and tool were called, what happened, and which guardrails were applied.
Require a way to connect records across AI clients, MCP servers, and business systems so reviewers can follow the sequence of events. Define which sensitive data should be excluded and what happens if logging fails.
6. Guardrails and Enforcement Mechanisms
State how the rules are enforced. If PII redaction is required, name the mechanism. If certain tools are read-only, say so. If changes to production systems require additional approval, define the workflow and explain how approval is checked before the action runs.
Choose permissions based on the team’s work. A support team using HubSpot may only need read-only tools, while developers using GitHub may need write access. Restrict destructive tools, such as file deletion, when the task doesn’t require them. Where those tools are needed, define the conditions for using them.
7. Consequences and Escalation
Define what happens when someone violates the policy, whether that’s a conversation, a formal warning, or access revocation. Keep the response proportionate and consistent with existing HR procedures.
Also explain whom employees should contact if they accidentally share sensitive data, an agent takes an unexpected action, or the policy doesn’t clearly cover their situation. If exceptions are allowed, specify who approves them, what they cover, and when they expire.
Who Owns the AI Usage Policy?
One person should be responsible for keeping the policy current, with clear contributions from IT, security, legal, and business teams. A practical way to divide the work is drafting, review, and approval.
- Drafting and maintenance: IT, platform engineering, or a dedicated AI governance lead writes and updates the policy. They understand what’s technically possible and what the tools actually do. Business teams help check whether the rules work for everyday tasks.
- Review and risk assessment: Security, privacy, and compliance teams check the policy against applicable regulations, contractual commitments, and internal security requirements. These may include GDPR, HIPAA, or DORA obligations, as well as requirements associated with ISO/IEC 27001 certification.
- Sign-off and authority: An executive sponsor, such as the CTO or CISO, or an AI governance council gives final approval, with legal and HR input where needed. Make clear who can approve exceptions and who has authority to suspend access.
How to Enforce an AI Usage Policy Technically
Technical controls put the policy into practice by checking access, filtering data, and recording activity. For MCP connections, MCP Manager provides an MCP gateway that brings these controls together between your AI clients and the servers they connect to.
Lock Down AI Client Configurations
Use your AI client’s admin settings to restrict which connectors employees can add. Where the client supports it, allow only the approved MCP gateway endpoint. The available controls depend on the client and plan, so check those settings before rollout.
Pair this with mobile device management (MDM) and endpoint controls to manage which clients and configurations employees can use on company devices. Follow the enterprise lockdown guidance and test whether users can still add an unapproved server directly.
Route MCP Traffic Through an MCP Gateway
An MCP gateway sits between your AI clients and the MCP servers they connect to. Routing connections through it gives you a central place to control tool access, filter data, and review activity. Each connected server still needs the appropriate credentials and permissions.
In MCP Manager, teams control access to MCP gateways, while roles define workspace-level capabilities. Administrators choose which tools each MCP gateway exposes. Teams that need different tools or rules can use separate MCP gateways.
Use feature provisioning to allow only the tools the workflow needs. Adding a server alone doesn’t restrict its tools; administrators need to configure those permissions.
The MCP gateway can only govern traffic that passes through it. Browser uploads, direct API calls, and local actions outside MCP need separate controls in the AI client, on the device, or in the connected system.
Apply Guardrails at Runtime
If your policy requires personal data to be filtered, configure rules that check it before it reaches the AI client or an external tool. MCP Manager supports regular expressions for structured data such as Social Security numbers, Microsoft Presidio for personal-data detection, and external rule engines connected through a webhook.
Some rules should apply across the organization, such as preventing secrets from being shared. Others depend on the team and task. Test that permitted work succeeds, prohibited data is blocked, and controls behave as intended if a detection engine fails.
Check the logs as well as the tool responses. A rule that removes personal data from a response doesn’t automatically remove it from stored logs. Original request data can still be recorded. Configure log storage separately to match your policy.
Ship Logs to Your Existing Observability Stack
If your security team already monitors infrastructure through a SIEM, AI agent activity should feed into the same workflow. Decide who reviews alerts and check that actions can be traced to their source.
MCP Manager offers OpenTelemetry log and trace export as an Enterprise capability. Send records to a compatible destination or through an OpenTelemetry Collector if format translation is needed. Check which data is exported and confirm that records arrive.
AI Policy Template: A Starting Framework
Use this as a starting point. Adapt the language to your organization’s size, industry, and risk tolerance.
Section 1: Purpose and Scope. Define which people, agents, and work-related AI activities the policy covers, including MCP connections.
Section 2: Approved Tools. List permitted AI applications, account types, and MCP servers. Explain how to request additions.
Section 3: Data Handling. Define permitted data categories, filtering and retention requirements, and procedures for personal-data requests.
Section 4: Access and Identity. Define authentication and offboarding requirements. Explain how actions are traced to users or agents, including when service accounts are used.
Section 5: Logging and Monitoring. Specify required records, retention periods, reviewer access, SIEM integration, and sensitive-data exclusions.
Section 6: Guardrails and Human Review. List data filters, tool permissions, and approval workflows. Define restrictions on destructive actions and when outputs need human review.
Section 7: Compliance. Map requirements to applicable laws, contracts, and certification commitments. Specify the evidence needed.
Section 8: Violations. Define consequences, incident reporting, exception approvals, and escalation contacts.
Section 9: Ownership and Review Cadence. Name the owner and approver, record the version, and set a review schedule. Update sooner after material changes.
Tips for Rolling Out Your AI Usage Policy
Start with a small group, test the rules against their everyday work, and use their feedback to improve the policy before expanding it across the organization.
- Start with the teams already using AI. Ask them what’s realistic and what’s missing. Test the connection instructions and request process with them.
- Don’t try to cover every edge case in version one. Cover the workflows you’re approving and give employees a clear way to ask about anything else.
- Make the governed path easy to follow. Keep the approved tool list, connection instructions, and request form easy to find. Check that the controls allow legitimate work.
- Explain how the policy helps people use AI. Show employees what they can do without additional approval and when they need to ask.
Your Policy Is Only as Strong as Your Enforcement
Writing an AI usage policy is the first step. Making it work means giving employees clear instructions, assigning responsibility, and testing the controls behind each rule.
MCP Manager gives you the MCP gateway, guardrails, logging, and access controls to enforce the MCP part of your policy. Built for organizations with demanding governance requirements, including highly regulated industries, it gives teams a central place to manage how AI connects to business systems. Book a demo to see how it can support your rollout.
FAQ
What is an AI usage policy?
An AI usage policy is an internal document that defines which AI tools employees can use, what data those tools can access, what guardrails are required, and how usage is monitored. It sets the rules for safe AI adoption across an organization.
What should an AI acceptable use policy include?
It should cover approved tools, data classification rules, identity requirements, logging, human review, and consequences for violations. If teams use MCP, include server approval and tool permissions. Explain how employees can report incidents or request exceptions.
Who should own the AI usage policy in an organization?
Assign one policy owner and share the work across relevant teams. IT or platform engineering drafts and maintains the technical rules, security and compliance review them, and an authorized executive or governance council approves the policy with legal input where needed.
How do I enforce an AI usage policy technically?
Use managed accounts, AI-client admin settings, and endpoint controls. Route MCP connections through an MCP gateway that applies access rules, data filtering, and logging. Monitor the logs and test the controls. AI activity outside MCP needs its own enforcement measures.
How often should an AI usage policy be reviewed?
Quarterly reviews are a practical starting point. Update the policy sooner when you adopt new tools, approve different data uses, identify a gap, or face new requirements. The schedule should reflect your organization’s risks and how often its AI use changes.
Is an AI usage policy required by law?
That depends on the jurisdiction, sector, and use case. For example, applicable DORA rules require documented ICT security procedures. An AI usage policy can help address those obligations, but the document alone doesn’t establish compliance.
What is the difference between an AI usage policy and an AI governance framework?
An AI usage policy is a specific document with rules for employees. An AI governance framework is the broader system of policies, tools, processes, and roles that make governance operational. The policy is one component of the framework.
How does an MCP gateway help enforce an AI usage policy?
An MCP gateway sits between AI clients and the servers they connect to, applying configured access controls, data filtering, and logging. It provides a central enforcement point for traffic routed through it. Client and endpoint controls help prevent connections that bypass it.
