A sanctioned AI tool is one your organisation has approved under contract, with defined data handling, retention and training terms, usually an enterprise tenant covered by a DPA. Everything else is unsanctioned, including a personal account on the same product.
The account, not the domain
This is where most policies go wrong.
chatgpt.com is not sanctioned or unsanctioned; the session is. Your enterprise tenant and an employee’s personal free account are the same hostname, the same interface, and entirely different legal positions.
A control that classifies by domain will mark both as approved. One that classifies by tenant or account context can tell them apart, and that difference is usually the difference between a governed disclosure and an ungoverned one.
Why severity should differ
The same finding is a different event.
A card number reaching your contracted tenant under a no-training DPA is a policy matter to correct. The same card number reaching a personal free-tier account is an uncontrolled third-party disclosure.
Scoring them identically produces a queue your analysts stop reading: mostly full of alerts about the tool you told everyone to use.
| Sanctioned tenant | Personal / unsanctioned | |
|---|---|---|
| Contract and DPA | ✓ | – |
| Training exclusion | ✓ | Depends on tier |
| Retention terms | Defined, often negotiable | Provider default |
| Deletion on request | Contractual | Best effort |
| BAA available, for PHI | Sometimes | – |
| Your audit rights | Defined | – |
In Itzal this is a per-framework parameter. PCI DSS might exempt nothing; an internal codename policy might warn only on unsanctioned destinations.
Sanctioning is not permanent
The failure modes worth a calendar reminder.
Terms change. A provider updates its data handling and your sanctioned tool is now governed by something you have not read. Re-verify at renewal, at minimum.
Features appear. An approved SaaS product ships an AI feature after your assessment. The vendor is still approved; a new data flow to a model provider is not. This is the third form of shadow AI, and it arrives without anyone deciding anything.
Questions
What makes a tool sanctioned rather than just allowed?
A contract with defined data handling terms. Tolerated means nobody has blocked it. Sanctioned means somebody has read what the provider may do with the data, agreed terms, and can point to them. The distinction decides what a policy can reasonably say.
Why classify by account instead of by domain?
Because the same hostname serves both a governed enterprise tenant and a personal account. Allowing the domain allows both, and the personal one carries none of the terms you negotiated. The signed-in account is the thing that differs.
Does sanctioning a tool mean findings stop mattering?
No. It changes what should happen when something is found, not whether it was found. A record going to a sanctioned tool under contract is a different risk from the same record going to a personal account, and the policy can say so.
How often should the list be reviewed?
Whenever the provider's terms change, which they do without notice. A list reviewed annually describes the terms that applied last year, and the page you agreed to is not the page in force today.
What about tools nobody has listed?
That is what discovery is for. Reporting the hostname of a tool nobody listed, and never its content, is how you find out which tools are actually in use before deciding which to sanction and which to have a conversation about.
Can a tool be sanctioned for one team and not another?
Yes, and that is usually the right answer. Engineering pasting code into an assistant and support pasting customer records into the same assistant are different risks, and a per-department policy is what lets one be approved without the other.
Keep reading
- Glossary Coverage gap A surface a control does not inspect. The dangerous ones are silent: indistinguishable from a surface with nothing on it. 3 min read
- Product Itzal Guard Checks what people type, paste and upload into ChatGPT, Claude, Gemini and seven other AI tools. Product page
- Product Admin console Violations by team and framework, case management, a per-framework policy editor. Product page
- Policy Writing an AI acceptable use policy The clauses that matter, the ones that get ignored, and why a policy written before you know your own usage is a guess. 6 min read