Authors
Many companies have no written rule for how staff may use AI tools. The rule that exists in practice is "use the shared login." This guide is a short policy you can adopt as written or edit to fit. It is deliberately one page. A policy nobody reads is not a policy.
1. Accounts
Every AI account used for work belongs to the company and is paid for by the company. Nobody uses a personal account for company work. People never hold a provider password or a provider key; they reach AI through a key issued to them.
2. Keys
Every person who uses AI tools for work receives one key in their own name. Keys are not shared, pasted into chat, or stored in shared documents. Provider keys are held server-side by the gateway and are never issued to individuals. Services and scripts receive their own keys, treated as a person for budget and logging purposes.
3. Models
Each team has a model list. People use models on their team's list. Requests for a model not on the list are refused by the gateway, and the person asks their team lead to add it if there is a reason. Teams review their list quarterly.
4. Budgets and caps
Each person has a monthly budget set by their team lead. An alert goes to the person and the lead at 80 percent. The key stops at 100 percent. Budgets can be raised by the lead during the month; they are not raised by the person. Team budgets sit inside the company allowance agreed with finance.
5. Logging and privacy
The gateway records who made each request, which model, how many tokens and what it cost. Prompt and response bodies are not stored unless a team has agreed full retention for a stated reason. People may view their own usage at any time. Team leads may view their team's usage. Nobody views another person's prompts without that person's knowledge.
6. Confidential data
Client code, contracts, customer data and personal data may be used with AI tools only through a company key, on company accounts, with the model list and retention settings the team has agreed. They are never pasted into a personal account or a shared login.
7. Leavers
A person's key is revoked on their last day as part of the standard offboarding checklist. Their usage log is kept for the company's retention period. Any shared password the person knew is changed the same day. See Offboarding someone who knows the AI password.
8. Review
This policy is reviewed every six months, or when a provider changes its terms, whichever is sooner.
That is the whole policy. If you want help adapting it to your team, or you want the gateway that makes points 2 to 7 automatic, book a call.