Look before you block
Audit mode: measure what data goes to AI before blocking
The system classifies and records without interfering. At the end you know what would have left, from which teams and in which kind of task.
Updated
What happens during those days
Your team works exactly as before. Every request is classified on the fly and noted: which data categories appeared, what kind of task it was (code, writing, a question), what the policy would have done had it been live, which model was used and what it cost. That classification is stored, not the text. Nothing is blocked and nobody has to change habits.
The report that comes out
A document with the share of requests containing sensitive data, the breakdown by team and category, the most repeated cases and a cost estimate against what you pay today. It is the material you then use to decide what gets blocked and what does not.
What we expect to find
What your pilot measures is where the volume really is. Our hypothesis is that it will not be the technical team but administration or customer support, and that it will rarely be whole documents: it will be fragments pasted in a hurry. Knowing it from your own data changes which policies make sense.
What is recorded and what is not
For each request we note who made it, which team they belong to, which model was used, which data categories appeared, what the policy would have done and what it cost. The text of messages is not stored.
From audit to policies
With the report you decide, by category, what is let through, what is masked and what is blocked, and you set the spend caps. You start with what is most frequent and most serious; the rest can wait. The company moves from audit mode to active mode when whoever administers decides.
Frequently asked questions
What is audit mode?
It is Acotia's initial state: the system classifies and records each request and notes what your policy would have done, but blocks and modifies nothing. It lets you find out what really happens before turning controls on.
Will my team notice audit mode?
They should not: they work with the same interface and the same models. It is advisable that they know the log exists; we recommend telling them openly.
What does the report contain?
The percentage of requests with sensitive data, the breakdown by team and category, the most repeated cases and a cost estimate against what you pay today.