What Are AI Safeguards?
AI Safeguards enable administrators to govern how AI operates within Egnyte. Policies control which files the AI can use to generate responses and which users can access AI-powered functionalities.
Two distinct governance needs are addressed:
- Data Visibility: Policies control which files are excluded from AI visibility, preventing them from being used to generate responses. This applies within Egnyte Collaborate and requests processed through the Egnyte MCP Server.
- Access Control: Policies restrict which users and groups have access to AI-powered functionalities. This supports phased rollouts and permanent exclusion of groups that do not need AI access.
This feature is available on the Essentials, Elite, and Ultimate plans, or for those who have purchased the AI Add-on. Please contact the Egnyte account manager or Egnyte Sales team for more information.
Benefits
- Prevent information from sensitive files such as contracts, HR records, and classified documents from appearing in AI responses.
- Roll out AI access to selected early adopters and expand coverage gradually over time.
- Control AI access per user and/or group without changing underlying file permissions.
- Sanitize content returned from the Egnyte MCP Server to external AI tools.
- Monitor AI activity across the domain before enabling any restrictions, using Report Only policies.
Common Use Cases
The following use cases are covered step-by-step in AI Safeguards - Admin Guide.
- Initial rollout: AI access is restricted to a single group during initial deployment. Access can be expanded to additional groups over time by extending the blocking policy.
- Department-scoped access: Departments can use AI but only within their designated folder. Cross-department access and all other users are blocked.
- Monitoring mode: Report Only policies are used to observe AI activity across the domain before any restrictions are applied.
- Sensitive content protection: AI is prevented from processing files classified as Confidential or PII, with selected compliance teams retaining access.
- Competitive confidentiality: Metadata tags are used to prevent AI from surfacing a client's files to users working on a competing project.
Overview
AI Safeguards policies are managed in Settings -> Configuration -> AI -> AI Safeguards section. Administrators can create, edit, reorder, and change the state of policies from this page.
Policy Criteria Types
Each policy is built using one or more criteria. Four types are available:
- Location: One or more folders. All subfolders are included by default when a parent folder is selected.
- Content Classification policies: Classification tags applied by Secure & Govern Content Classification Policies. Exclusive to the Ultimate plan.
- Metadata tags: Metadata applied to files in Egnyte Collaborate. Currently, single-select, multi-select, string, integer, and label metadata types are supported.
-
Users/Groups: Specific users and group identifiers.
- Multiple criteria rows within a single policy are joined with AND. All rows must match for the policy to activate.
- Multiple values within a single criterion use OR. Only one value needs to match.
Policy States
Each policy can be in one of three states. Administrators can choose whether a newly saved policy defaults to Active or Report Only.
- Active: Restrictions are applied.
- Mask: The content matched by the selected Content Classification policies is removed and replaced with a label, such as < SSN > or < ACCOUNT_NUMBER >, before the file is sent to AI. Users will still get answers from the rest of the document.
- Report Only: Restrictions are tracked for reporting but not applied. Useful for monitoring activity before restrictions.
- Inactive: Restrictions are not applied.
Mask is available when the classification criterion in the AI Safeguard policy is set to "included in."
Policy Priority and Evaluation
Policies are evaluated sequentially, starting from Policy 1. The priority number is shown on the left of each policy row. Evaluation behavior depends on the matching policy's state:
- Report Only: Evaluation continues to the next policy after a match. Multiple Report Only policies can match the same request, each adding a Flagged audit report entry.
- Block or Mask: Evaluation stops immediately once a match is found. One Blocked report entry is created. No further policies are evaluated for that request.
Report Only policies intended to monitor the same scope as an Block policy must be placed above it in the priority list. An Block policy stops evaluation. Report Only policies placed below Block policies will not be evaluated for requests that the Block policy already matched.
Priority order can be changed using the drag-and-drop handle on the left of each policy row.
Special Behavior: Users/Groups-Only Policies
A policy using only the Users/Groups criterion enters a special mode. In addition to restricting AI processing, it removes all AI-related entry points from the user interface for matched users. AI Assistant, Agents and all other AI surfaces are hidden entirely, with no visible indication that a restriction is in place.
External tools connecting through the Egnyte MCP Server can still connect on behalf of these users. AI Safeguards policies apply to all inbound requests and the content returned is sanitized accordingly.
This mode is recommended for hard blocks during initial rollout or for groups that should never have AI access.
Audit Reports
Audit reports are available in the Reports panel under Audit → AI Safeguards:
Users can navigate to either of the reports, click on New Report, fill in the details, and Submit to create a report.
- Blocked: Files considered for use by the AI but blocked from generating responses. Files that matched a policy set to Mask also appear in this report.
-
Flagged (report-only): Files that would have been blocked, but were not, because the matching policy was set to Report Only. Useful for investigating activity without disrupting workflows.
Both Blocked and Flagged (report-only) reports include details such as Date, Policy Name, File, Requestor Name, and Requestor email. -
Policy Settings: Logs when an AI Safeguards policy is created, modified, deleted, or reordered. The report includes Date, Performed by, IP Address, Action, Policy Name, Position, Policy Active, Match action, Old Criteria, and New Criteria.
User Experience
When a user interacts with a file protected by an Block policy (and they are not excluded entirely from using AI), the file is not processed and the user is informed that the item is protected by AI Safeguards. Files restricted through the MCP Server are not returned to the requesting application.
When a file matches a policy set to Mask, the file is processed with the matched content replaced by labels such as < SSN >. Users receive an answer based on the remaining content, and the masked values are not available to AI.
If user would like an excluded file to be available for AI processing:
- Contact the Egnyte administrator to find out why the file is restricted.
- Request policy configuration adjustments.
When at least one Block or Mask policy is in place on the domain, the "AI Safeguards active" indicator is shown in the AI Assistant panel.
Additional information is shown in the context menu, and when the user tries to interact with a restricted file.
Limitations
- Users on Egnyte for Android older than v.9.5 or Mobile App for iOS older than v.9.5 may still see AI entry points even when a Users or Groups-only policy applies to them.
- Changes to policies may take up to one hour to finish processing and take effect.
- Because certain file formats, such as spreadsheets (XLSX, CSV), are inherently complex, they are blocked automatically whenever a Mask policy is triggered.
- Since Mask policies redact sensitive information prior to analysis, generated outputs for heavily sanitized documents or PDFs might lack complete context or detail.
Additional Resources