Admin-defined policy drives all controls within the F5 Workforce AI Security platform. Workforce AI Security tenants use two types of policy. The Default Policy applies to all members of a tenant. Group Policy applies to a specific group of users within a tenant.

Together, these policies control which GenAI sites users can access and which sensitive data entities are monitored. They also control which MCP tools are available to GenAI applications and which intent topics are monitored.

Without Workforce AI Security, organizations have no way to see how the workforce uses GenAI. They also have no way to see where policy violations occur. Because of this, when a tenant is first deployed, Workforce AI Security configures it in Monitor mode by default. This allows admins and security stakeholders to capture usage data. It also lets them evaluate the risks occurring within the organization.

Workforce interactions with GenAI services are monitored. Violations are logged without altering the user experience. This mode generates data about GenAI use within the organization. Admins can use this data to define the first iterations of policy. When an organization is ready to apply policy, admins can toggle the Default Public Service Action setting. They can move it from Allow - Monitor to Allow - Protect to Block, at either the default or group policy level. Workforce AI Security then applies the defined policy.

Admins can explicitly block specific services using the Service Block List. This is in addition to the Default Public Service Action setting. This feature is available in both the Default Policy and Group Policies. It provides granular control over which services are blocked for users.

The Service Block List operates with the following behaviors:

This feature allows organizations to maintain a permissive default service action while still preventing access to specific services. For example, admins can set the default service action to Allow - Protect to allow access to most GenAI services. They can then explicitly block specific services that are not approved for organizational use.

Workforce AI Security, like other security products, practices a least privilege approach to the workforce use of GenAI. Because of this, administrators must add access to all resources that Workforce AI Security protects. They do this using the default and group policies. These policies govern the use of public services.

Group policies can only be used to provide additional access and lessen restrictions on users. This means that users can be members of multiple group policies. Each group policy can add additional access to the user.

The Services tab controls which public GenAI services users can access. It also controls what happens when access to a service is blocked. Admins can build an allowed list of services and block specific services regardless of the default service action. They can also configure how blocked access attempts are handled.

Allows specific public GenAI services like ChatGPT, Claude, or Microsoft Copilot for users in this policy.

Blocks specific services regardless of the default service action setting. Services in the block list are always blocked. This is true even when the default service action is set to Allow - Monitor or Allow - Protect.

When a user attempts to access a blocked service, the Service Block Action determines what happens next. Admins choose one of two options. A no-access page tells the user they aren't permitted to access the site or service. Redirect to URL sends the user to a customer-defined URL, usually either an approved GenAI service or the organization's acceptable use policy.

Workforce AI Security discovers MCP Tools by monitoring MCP usage in AI tools across the workforce. Workforce AI Security intercepts MCP payloads. It then removes tools that are either blocked by policy or in violation of capability requirements. This includes tools that are not read-only. When a tool violates policy, Workforce AI Security removes it from the MCP payload. This happens before the payload is sent to the backend service. This means the service cannot use that tool.

Explicitly blocks specific MCP tools that have been discovered in the environment. Blocked tools are removed from MCP payloads before they reach backend services.

Explicitly allows specific MCP tools that have been discovered in the environment. Allowed tools will always be included in MCP payloads.

When enabled, automatically allows all read-only MCP tools without requiring them to be added to the Allow List. Because of this, admins do not need to add each read-only tool to the Allow List individually.

Determines the default action taken for MCP tools. These are tools that are not explicitly allowed or blocked. This setting provides control over how the system handles tools. These are tools that fall outside of the defined block and allow lists.

The Sensitive Data tab includes Content Controls and PII Detection settings. These settings monitor, redact, or block sensitive information in requests to public GenAI services. For detailed information about Content Controls (High-risk Request, Confidential Data, Programming Language, Harmful Content, Prompt Injection) and PII Detection Settings, refer to the Sensitive Data policy documentation.

Inspect requests for risky patterns. Examples include harmful content, prompt injection, high-risk heuristics, code, and potential confidential data. Available actions include Monitor, Warn, Tag, Mask, Delete, and Block. This depends on the control type.

Enable or disable detection of personally identifiable information in requests to public services. Then choose a global action that applies to all enabled PII entities.

Select specific types of personally identifiable information to detect. Examples include Phone Number, Credit Card, Email Address, Social Security Number, and others. Entities can be filtered by compliance framework including GDPR, CCPA/CPRA, PCI/DSS, HIPAA, GLBA, and FERPA.

Intent Topics allow organizations to create custom categories of prompts to monitor or block within their environment. For example, an organization might want to monitor for prompts that involve medical diagnostics or gambling. It can then ensure that those prompts are blocked on organization systems. This capability allows organizations to tailor policy to their specific vertical or business needs.

Creating an Intent Topic requires a list of 50 to 200 sample prompts that represent the category. Generating these samples with GenAI is recommended. The sample prompts are turned into vector embeddings. This allows Workforce AI Security to quickly match user prompts against the customer-defined intent topics.

Choose which action is taken when a GenAI request matches a defined intent topic. Actions can include Monitor, Warn, or Block. This depends on the sensitivity of the topic and organizational requirements.

The Workforce AI Security default policy applies to all users in a Workforce AI Security tenant. The default policy should be the most restrictive policy. It should grant access to only services or resources that have been approved to the entire organization. Group policies should be used to provide access to services and resources to targeted groups of users.

If the organization has approved all users for access to a specific GenAI site, like Microsoft Copilot, adding it to the Default Policy makes the most sense. This is because all users gain access to services and resources from the Default Policy. Another valid configuration is to allow no access to any services or resources by default.

Group Policies are used to add or allow additional access to services and/or resources. This is over what is granted via the Default Policy. Group Policies are applied to users by associating a group (either manually created or imported via the Directory Sync feature) to a Workforce AI Security Group Policy.

Group policies are additive. A user can have multiple group policies applied at the same time. Group Policies contain the same settings as the Default Policy. These settings are applied to a more specific set of users.

Sensitive Data settings are also built from least restrictive to most restrictive. Group Policies are additive and can only add access or reduce restrictions. As a result, admins cannot enable or change Sensitive Data settings in Group Policy. This is true if those settings are disabled in the Default Policy. This is because the Default Policy must always be more restrictive than Group Policy.

Admins must set up the most restrictive Sensitive Data settings at the Default Policy level. Exceptions can then be made within Group Policy to allow or lessen the action for detecting sensitive data.

For example, admins can exempt a group of users from phone number monitoring. They do this by disabling the PII entity for phone numbers in that group's Group Policy. This exception is only available if the Default Policy has the sensitive data setting enabled. If it is disabled at the Default Policy level, no change can be made in Group Policy.

Add Microsoft Copilot to the Default Policy of the organization.

Add ChatGPT to the Group Policy that is assigned to the group of users that require the access.

Enable the desired PII entities in the PII Detection settings. Set the Action to Delete

Set the PII Detection settings to Log only

NOTE: Group policies can only allow access or reduce restrictions. As a result, the Block action won't be an option in the group policy settings for this example. Only actions that are less restrictive can be selective.

Enable the URL PII entity

Disable the URL PII entity

NOTE: Group policies can only allow access or reduce restrictions. As a result, in this example, PII entities can only be disabled in group policies. PII entities that are not enabled in the Default Policy can not be enabled in a group policy.

This use case demonstrates using the Service Block List to prevent access to specific services. It also shows how to maintain a permissive default service action while doing so.

Set the Default Public Service Action to Allow - Protect. This allows access to most GenAI services with data protection enabled. Add specific services like DeepSeek, Grammarly, and Grok to the Service Block List. This prevents access to these services.

Set the Service Block Action to Redirect to URL. This guides users to approved alternatives when they attempt to access blocked services.

Users will have access to most GenAI services with data protection applied. However, attempts to access DeepSeek, Grammarly, or Grok will be blocked. Users will be redirected to that URL. This approach allows organizations to maintain broad access while preventing use of specific unapproved services.

This use case demonstrates how the additive nature of the Service Block List allows admins to block services broadly. It also shows how admins can make exceptions for specific groups.

Add a specific service to the Service Block List to block it for all users by default.

For the group that needs access to the blocked service, do not add the service to the Service Block List in the group policy. Instead, add the service to the Allowed Services list.

Most users will have the service blocked. However, users in the specific group policy will have access. However, note that block lists are concatenated. If the service is in the Default Policy block list, it will be blocked for all users. This happens regardless of group policy settings. To enable service-level exceptions, admins should use the Block default service action. They should then manage access through the Allowed Services lists instead of the Service Block List.

This use case demonstrates how to use MCP tool controls to allow safe read-only operations. It also shows how to prevent potentially risky tool usage.

Navigate to the MCP Tools tab in the Default Policy. Enable the Allow Read-only toggle to automatically permit all read-only MCP tools. Add specific high-risk tools to the MCP Tool Block List. Examples include tools that provide file system access, web scraping capabilities, or external API calls that could exfiltrate data. Set the Catch-all Action to Monitor to observe tools that fall outside of the block and allow lists.

Read-only MCP tools will work automatically without requiring manual approval. This reduces administrative overhead while maintaining security. High-risk tools added to the block list will be removed from MCP payloads before reaching backend services. This prevents their use. The Monitor action on uncategorized tools provides visibility into tool usage patterns. This allows admins to refine their block and allow lists over time based on actual usage.

The policy that is being applied to a user can be verified using the admin interface at https://admin.surepath.ai: