Somewhere in your business today, someone is pasting company data into a public AI tool on a personal account. Not out of malice — out of deadline. The sanctioned option is slower, weaker, or missing, and the tool in their pocket is excellent. A ban won't fix that; a better governed option will.
The real question
Browser-security research (LayerX) found roughly one employee in five pastes into generative AI tools, more than half of what they paste is corporate data, and most flows through personal, unmanaged accounts — and 80% of US CISOs rank this among their top concerns. Blocking the domains fails the same way everywhere: usage moves to phones, where you see nothing. The real question isn't how to stop people using AI — it's why they're going around you. People route around governance when the governed path is worse than the ungoverned one.
How to do it
Start with substitution, not prohibition. Give people a governed workspace whose models are as capable as the ones they're sneaking off to use — chosen and enabled deliberately by your organisation, under terms you negotiated. If the approved tool is a downgrade, no policy document will save you. Nobody pastes into a personal account when the sanctioned tool is the better tool.
Then put your work identity in front of it. Staff sign in with the company account they already have — no personal sign-ups, no unmanaged accounts holding company prompts. Joiners get access automatically; leavers lose it the day they leave. The account the conversation lives in belongs to the organisation, not the individual.
Finally, make usage visible instead of invisible. When every conversation runs under a named work identity, "who is using AI, on which models, at what cost" stops being a survey question and becomes a dashboard.
What this looks like
In Pebble, this looks like: the administrator connects the model subscriptions the organisation already pays for and enables the vetted models — the same calibre people were reaching for on personal accounts. Staff sign in with their Microsoft Entra identity; SCIM provisioning means access follows employment. An analyst who used to paste report extracts into a personal chatbot now runs the same job in the governed workspace: better model, company account, conversation on the record. In PebbleObserve, the administrator sees usage, cost, and logs per model and endpoint, and every user gets a self-service usage page. "How much of our data is going into AI?" finally has an answer.
Why this holds up in a regulated business
- Organisations can use centrally managed model subscriptions, and admins control which models are enabled and provisioned per organisation and workspace.
- Routing strategy is admin-set and applies service-wide.
- Microsoft Entra SSO and SCIM provisioning are supported, with group assignment driving who gets access.
- Usage, cost, and logs are visible per model, key, and endpoint, with a self-service usage page for every user; traces attribute activity by user email or full name, admin-configurable.
- Deployed across US, Europe and Australia.
One honest limit: we don't monitor clipboards or block pastes into other vendors' tools — this is substitution and visibility, not surveillance.
Where to start
Pick the team under the most deadline pressure — they usually have the worst paste habit — and give them the governed workspace first, with models good enough that the personal account loses its appeal. Then watch the usage dashboard, not the firewall logs. Make the safe path the best path.
Pebble Powered AI.
