F5 Workforce AI Security is a network-level governance platform for Generative AI adoption.

You can start with basic monitoring to see GenAI usage patterns. Add more controls as your governance strategy matures. This phased approach gives you data for policy decisions. You avoid restricting access without insight into usage.

Each section is marked Required, Recommended, or Optional. This helps you choose setup tasks based on your needs and timeline.

The initial setup establishes the foundation of your deployment. This includes the admin framework and identity and access. It also includes the network integration needed to intercept GenAI traffic.

Admin users are the foundation of your tenant. Directory Synchronization imports end users automatically. You must add admin users manually. Assign each admin a role: Owner, Admin, or Auditor. Each role controls their level of access to Workforce AI Security.

You first access your tenant with Magic Link. As the initial Owner, add any more admin users you need. Base this on who needs access. Consider who configures policies, reviews user activity, or audits Workforce AI Security.

Learn more:Configure admin users

Single Sign-On (SSO) integration lets your end users log in to Workforce AI Security. They use your existing identity provider. This centralizes identity management. It also ensures audit logs and analytics attribute user activity to specific people.

Workforce AI Security supports OIDC (OpenID Connect) and SAML 2.0, and works with most major identity providers. SSO is recommended. It logs users in when Workforce AI Security intercepts traffic. Without SSO, users log in with Magic Link instead.

Learn more:Configure SSO for all providers

Directory Synchronization uses the SCIM protocol (System for Cross-domain Identity Management). It imports user and group data from your directory. This data goes into Workforce AI Security. This supports group-based policy enforcement. It also keeps your setup in sync as your workforce changes.

You can create and manage groups manually, but directory sync is recommended. It keeps user and group membership current as your workforce changes. Employees join, leave, or change roles over time. Workforce AI Security reflects those changes automatically, with no manual work needed.

Directory sync also lets you use existing security groups for policy enforcement. For example, an Engineering group from the directory can grant GenAI access. It does this through a Group Policy.

Learn more:Configure Directory Sync for all vendors

Network integration lets Workforce AI Security intercept and inspect traffic. It then governs traffic by policy. This traffic goes to public GenAI services. Without network integration, Workforce AI Security cannot apply policies. This applies to services like ChatGPT, Claude, or Gemini.

Network integration is not required to access the Workforce AI Security admin interface. That interface is always directly accessible.

There are two main approaches. These are SASE (Secure Access Service Edge) and Proxy PAC (Proxy Auto-Configuration). SASE is the preferred method. It uses vendor-specific forward proxy chaining, often called forward-to-proxy. This sends only GenAI traffic to Workforce AI Security. Other web traffic stays on its normal path.

If you don't have a SASE deployment, use Proxy PAC instead. Proxy PAC uses Mobile Device Management (MDM) platforms. These send a PAC file URL to endpoints. Both methods steer only GenAI traffic to Workforce AI Security. There, it goes through review and policy enforcement.

Learn more:Network Integration

After initial setup, your tenant monitors all GenAI traffic by default. It also logs that traffic. This puts insight and data collection ahead of policy enforcement.

By default, the Default Public Service Action is set to Allow - Monitor. Your workforce keeps using public GenAI services as normal. Workforce AI Security intercepts every interaction. It records and checks each one.

This happens in the background. Users see no disruption or blocking. They keep using ChatGPT, Claude, Gemini, and other GenAI tools as before.

Workforce AI Security captures a full audit trail of GenAI usage. This includes which services are used. It also includes the prompts and responses exchanged. It also shows whether Workforce AI Security flags sensitive data. This includes risky content too.

Enforce policy only after you understand usage patterns. An overly restrictive policy hurts productivity. An overly permissive policy fails to reduce risk.

During this initial phase, review the User Activity logs. Also review the analytics dashboards and violation reports. Look for:

This data lets you move from monitoring-only to active policy enforcement. Wait until you have enough evidence for balanced policies. There is no set timeline. Some companies transition after a week of data collection. Others take a month or more.

To begin enforcing policy:

Network integration must be in place first. Then Workforce AI Security captures GenAI activity across your workforce. It checks each event. This gives you two tools. User Activity supports event-level review. Insights supports dashboard analytics.

User Activity stores up to 30 days of governed GenAI events. You can review who used which services, when, and why. Each event includes user identity, risk level, and policy outcome. It also includes intent classification and full conversation history when available.

You can filter and search events. You can also look into specific requests. You can also export CSV files for offline review. Use this data to investigate policy violations and run security audits. You can also see how specific users or teams use GenAI.

Insights turns raw event data into dashboards. These cover Public Services, Risk, and Adoption. These dashboards help you:

Insights supports filtering with unlimited look-back. It also supports drill-through to raw transactions. It supports automated PDF exports and email subscriptions too.

Most companies use User Activity for day-to-day checks and audits. They use Insights to report usage trends to business leaders.

Telemetry Offload exports user activity logs to a customer-managed AWS S3 bucket. This supports long-term storage, SIEM integration, compliance archives, and analytics. By default, Workforce AI Security keeps user activity logs internally. Telemetry Offload copies that data to your own systems instead. This supports compliance, cross-system use, and custom reporting.

Telemetry Offload files upload to the S3 bucket every 15 minutes. They upload in JSON format. To enable this feature:

Gather data from the initial monitoring phase first. Then create a Public Service Policy. This sets which public GenAI services your workforce can access. It also sets what content controls apply. The policy also determines how it protects sensitive data.

Public Service Policies use a least-privilege model. A Default Policy applies to all users. Optional Group Policies grant more access to specific groups.

The policy framework has three components:

Most companies start with less restrictive actions, like Monitor or Warn. They move to stronger enforcement as governance grows.

Private models are GenAI foundation models. You run them in your own cloud account. This may be AWS, Azure, or Google Cloud. You make them available to your workforce through policy.

To enable private models, first create a connector. This connector authenticates Workforce AI Security to the cloud AI services. Workforce AI Security supports AWS (Bedrock) with an assumed role. It also supports Azure OpenAI and Google Gemini with API keys.

Setup involves three steps:

You control access to private models through Default Policy and Group Policies. This works the same way as public service access.

You access private models through the Gateway and Model Router. The router sends supported AI tool traffic to your private models. Set the Model Router at the policy level. Turn it on for Default Policy or any Group Policy. Today the Model Router covers Claude Code. More coverage is planned.

Model inference charges for private models go to your cloud provider account. This may be AWS, Azure, or Google Cloud. Charges don't go to Workforce AI Security. Watch your cloud usage and costs as you roll out private model access.

Consider these areas as your GenAI governance program grows: