L3 Networks · Framework

AI Governance Control Matrix

A practical framework for connecting AI governance requirements to the identity, network, application, data protection, and monitoring controls needed to enforce them.

AI governance is not achieved through policy alone. Organizations also need the technical ability to identify AI usage, control access, protect sensitive information, review integrations, and investigate incidents. This matrix provides a starting point for evaluating whether those capabilities are in place.

Know who is using AI

Key Risk

Users may access AI through personal accounts or unmanaged identities.

Technical Controls

SSOMFAConditional AccessDevice Compliance

Evidence to Review

Sign-in logs, user assignments, device status, access review results

Leadership Question

Can AI activity be tied to a managed user, device, location, and authentication method?

Discover AI tools in use

Key Risk

Shadow AI may operate outside approved software inventories.

Technical Controls

CASBSecure Web GatewayDNS SecuritySaaS Discovery

Evidence to Review

Cloud application reports, DNS logs, web traffic, browser extension inventories

Leadership Question

Can we identify both approved and unsanctioned AI services?

Protect sensitive data

Key Risk

Confidential or regulated data may be submitted through prompts, uploads, transcripts, or copied content.

Technical Controls

DLPData ClassificationEndpoint ControlsBrowser Controls

Evidence to Review

DLP alerts, file activity, upload events, sensitivity labels, endpoint telemetry

Leadership Question

Can we distinguish normal AI use from the exposure of sensitive information?

Control AI integrations

Key Risk

AI applications may receive excessive or tenant-wide permissions.

Technical Controls

OAuth GovernanceApp Consent ControlsLeast PrivilegeAccess Reviews

Evidence to Review

Enterprise applications, service principals, delegated permissions, application permissions

Leadership Question

Do we know which AI tools can access core systems and what permissions they hold?

Restrict unauthorized use

Key Risk

Employees may use unapproved tools despite policy restrictions.

Technical Controls

Web FilteringGroup-Based PoliciesDevice RestrictionsSession Controls

Evidence to Review

Blocked application events, policy exceptions, device posture, web access logs

Leadership Question

Can we apply different AI access policies by user, device, department, or risk level?

Assess vendor risk

Key Risk

AI vendors may retain, process, or reuse organizational data in ways that are not understood.

Technical Controls

Vendor ReviewContract ControlsData Retention ReviewRisk Scoring

Evidence to Review

Security assessments, privacy terms, retention policies, subprocessors, contractual protections

Leadership Question

Do we understand how every AI vendor handles our data?

Investigate AI-related incidents

Key Risk

Insufficient logging may prevent the organization from reconstructing an event.

Technical Controls

SIEMIdentity LogsEndpoint TelemetrySaaS Audit Logs

Evidence to Review

Centralized logs, alert history, retention settings, incident response records

Leadership Question

Could we determine who used an AI service, what data was involved, and when it occurred?

Demonstrate oversight

Key Risk

Leadership may lack consolidated reporting on AI adoption, risk, and remediation.

Technical Controls

DashboardsRisk RegistersReview CadenceExecutive Reporting

Evidence to Review

AI inventory, risk ratings, open findings, owner assignments, remediation status

Leadership Question

Can leadership see where AI is being used and where unresolved exposure remains?

Governance Objective	Key Risk	Technical Controls	Evidence to Review	Leadership Question
Know who is using AI	Users may access AI through personal accounts or unmanaged identities.	SSOMFAConditional AccessDevice Compliance	Sign-in logs, user assignments, device status, access review results	Can AI activity be tied to a managed user, device, location, and authentication method?
Discover AI tools in use	Shadow AI may operate outside approved software inventories.	CASBSecure Web GatewayDNS SecuritySaaS Discovery	Cloud application reports, DNS logs, web traffic, browser extension inventories	Can we identify both approved and unsanctioned AI services?
Protect sensitive data	Confidential or regulated data may be submitted through prompts, uploads, transcripts, or copied content.	DLPData ClassificationEndpoint ControlsBrowser Controls	DLP alerts, file activity, upload events, sensitivity labels, endpoint telemetry	Can we distinguish normal AI use from the exposure of sensitive information?
Control AI integrations	AI applications may receive excessive or tenant-wide permissions.	OAuth GovernanceApp Consent ControlsLeast PrivilegeAccess Reviews	Enterprise applications, service principals, delegated permissions, application permissions	Do we know which AI tools can access core systems and what permissions they hold?
Restrict unauthorized use	Employees may use unapproved tools despite policy restrictions.	Web FilteringGroup-Based PoliciesDevice RestrictionsSession Controls	Blocked application events, policy exceptions, device posture, web access logs	Can we apply different AI access policies by user, device, department, or risk level?
Assess vendor risk	AI vendors may retain, process, or reuse organizational data in ways that are not understood.	Vendor ReviewContract ControlsData Retention ReviewRisk Scoring	Security assessments, privacy terms, retention policies, subprocessors, contractual protections	Do we understand how every AI vendor handles our data?
Investigate AI-related incidents	Insufficient logging may prevent the organization from reconstructing an event.	SIEMIdentity LogsEndpoint TelemetrySaaS Audit Logs	Centralized logs, alert history, retention settings, incident response records	Could we determine who used an AI service, what data was involved, and when it occurred?
Demonstrate oversight	Leadership may lack consolidated reporting on AI adoption, risk, and remediation.	DashboardsRisk RegistersReview CadenceExecutive Reporting	AI inventory, risk ratings, open findings, owner assignments, remediation status	Can leadership see where AI is being used and where unresolved exposure remains?

Leadership

Executive Readiness Questions

Leadership should be able to answer each of the following with confidence.

Do we know which AI services are accessed from corporate devices and networks?
Can we distinguish approved enterprise AI accounts from personal accounts?
Do we know which AI tools have access to Microsoft 365 and other business platforms?
Can we identify what sensitive data is being submitted to external AI services?
Are AI-related OAuth permissions and integrations reviewed on a recurring basis?
Can we enforce AI policies by user, department, device, data type, or risk level?
Do we retain enough evidence to investigate an AI-related security or privacy incident?
Does leadership receive consolidated reporting on AI adoption, risk, and remediation?

Roadmap

Suggested Implementation Roadmap

Phase 01

Establish Visibility

Inventory AI applications and features
Identify connected systems and permissions
Review identity, web, DNS, and SaaS activity
Document business owners and use cases

Phase 02

Apply Controls

Define approved and restricted AI services
Reduce excessive application permissions
Apply identity, device, and data controls
Complete vendor security and privacy reviews

Phase 03

Maintain Oversight

Centralize AI-related monitoring and logs
Review permissions and vendors regularly
Track open findings and remediation
Report AI adoption and risk to leadership

Key Takeaway

Policy alone is not governance

Policy defines acceptable AI use, but technical controls determine whether those expectations can be observed, enforced, and verified. Effective AI governance requires identity, network, application, data protection, vendor risk, and monitoring capabilities to work together.

Put the Matrix to Work

Pair this framework with a structured assessment, or talk with L3 about the controls that make AI governance enforceable.

AI Control Gap Checklist AI Control Gap Analysis Related article Schedule a conversation