What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Default rule: employees should use only employer-approved AI agent services with employer-managed work accounts for work activity. A personal account may be used for work only when your organization has explicitly approved that service, data use, and access path. Personal-device (BYOD) access is a separate decision: it requires device, data-separation, monitoring, and privacy rules of its own.
What an AI agent policy must decide
An AI assistant that drafts text or answers questions has a different risk profile from an agent that can call tools, read business systems, send messages, change records, or approve transactions. Your policy should define both categories and apply stronger controls as an agent gains access and autonomy.
- Assistant: generates or summarizes content from a prompt but does not independently invoke business tools.
- Connected agent: can retrieve information through connectors, APIs, files, or business applications.
- Action-taking agent: can create, modify, delete, send, purchase, publish, authorize, or otherwise affect a system or person.
State whether the rule covers employees, contractors, interns, temporary staff, and service providers. State separately whether it covers personally owned phones and computers. A personal account is an identity held with an AI provider; a personal device is hardware controlled by the employee. They are not interchangeable policy questions.
Start with a plain employee rule
Put the operational rule near the top of the policy, in language managers can repeat:
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Use only company-authorized AI services for work. Sign in with the company account designated for that service. Do not enter confidential, regulated, credential, customer, employee, or unpublished business information into an unapproved service or personal account. Do not connect an agent to company systems or allow it to take consequential actions without registration, owner approval, and the controls in this policy.
Microsoft’s employee safety guidance uses the direct instruction, “Use only company-authorized AI services.” It also tells employees to “Always double-check AI-generated results before using them in your work.” Include both ideas in your rule: authorization controls where data goes, and human verification controls what the organization relies on.
Give employees a usable alternative. Publish the approved-service list, the required sign-in method, a help channel, an exception owner, and an interim safe option for urgent work. A prohibition without a route to perform legitimate work encourages shadow use.
Free tools Windows power users keep installed
One-click scans. No signup required.
Approved services and account requirements
Publish an inventory, not a vague “approved AI” statement
For each permitted service, record its name and edition, approved use cases, required account type, allowed data classes, enabled connectors, retention and logging settings, support owner, and review date. Identify whether the service is approved for ordinary drafting only or for connected and action-taking agents.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Policy item | What to specify |
|---|---|
| Service | Exact product, edition, tenant or workspace, and region where relevant. |
| Identity | Required company identity, single sign-on path, groups, and whether personal sign-in is prohibited. |
| Use cases | Examples such as brainstorming public copy, internal summarization, coding, or customer support. |
| Data | Classification levels allowed, prohibited fields, and upload or connector restrictions. |
| Controls | Retention, audit logs, administrator settings, data-loss prevention, and support contacts. |
| Owner | Business owner, technical owner, security reviewer, and next review date. |
Why a work account is the default
Microsoft advises using a work account for Microsoft 365 Copilot experiences so organizational protections can apply. The same principle is useful beyond that product: a managed identity enables access conditions, centralized offboarding, auditability, support, and contractual review. A personal account generally sits outside those controls, even when the employee is using a company laptop.
Personal accounts
Write “personal accounts may not be used for work information” unless a documented exception says otherwise. An exception must name the service, purpose, data classes, retention terms, duration, approving authority, and required safeguards. Approval of a personal account for one low-risk use does not authorize uploads, connectors, plugins, or action-taking features generally.
Request and exception route
- Employee submits the service, business purpose, data types, expected users, required integrations, and whether the agent will take actions.
- Manager confirms the business need and identifies an accountable owner.
- IT or security reviews identity, permissions, logging, connectors, and technical controls.
- Privacy, procurement, and legal reviewers assess data processing, terms, retention, and sector or jurisdiction requirements when applicable.
- The approver records a time-limited decision, conditions, and review date.
- The employee uses the approved work identity and reports any change in scope before adding data or tools.
Until a decision is made, use the organization’s approved alternative or keep the information out of the service. Emergency access should have an expiry and a post-use review.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteSet data boundaries by classification
Map your existing information-classification scheme to explicit AI rules. Microsoft’s employee guidance warns against putting confidential or sensitive company information or personal information into an unapproved AI service. Do not rely on employees to infer what “sensitive” means.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Information class | Unapproved personal account | Approved service or agent | Required treatment |
|---|---|---|---|
| Public | May be acceptable only when no work context, hidden metadata, or personal data is included. | Usually allowed within the approved use case. | Check that the input is genuinely public and that output will not create a misleading endorsement. |
| Internal | Do not enter. | Allow only in an approved tenant with documented settings. | Use the minimum necessary text and remove unrelated identifiers. |
| Confidential or proprietary | Prohibited. | Allow only after service, retention, access, and logging review. | Limit connectors and recipients; require human review before external release. |
| Personal, customer, or employee data | Prohibited unless privacy leadership has expressly approved the use. | Purpose limitation, minimization, access control, and retention requirements apply. | Use de-identification where feasible and document the lawful and policy basis. |
| Regulated, credential, or security data | Prohibited. | Only a specifically authorized workflow with stronger controls. | Never paste passwords, tokens, private keys, full payment data, or incident secrets into prompts. |
| Unpublished business plans, legal advice, or merger information | Prohibited. | Require explicit owner and legal or security approval. | Restrict people, connectors, retention, and export paths. |
Prompt and output handling
- Use the minimum data needed for the task; remove names, account numbers, and other identifiers when they are not necessary.
- Do not assume an approved service has the same retention or service-improvement terms as another service. Check the contract, tenant settings, and current product documentation.
- Treat generated text, code, classifications, and recommendations as unverified until a qualified person checks accuracy, confidentiality, copyright or licensing implications, and audience.
- Apply the same classification to an output that contains or reveals protected information. Store and share it through approved systems.
Govern agents as software identities
An agent with delegated access is not merely a chat feature. Register it as a software identity with a named owner, purpose, lifecycle, permissions, connectors, action limits, logs, and revocation method. Microsoft’s agent-governance guidance emphasizes centralized governance, least-data access, lifecycle management, and oversight.
Minimum registration record
- Unique name and inventory identifier.
- Business purpose and prohibited uses.
- Accountable business owner and technical maintainer.
- Data sources, connectors, APIs, and environments it can reach.
- Permissions, service accounts, secrets, and authentication method.
- Actions it may perform, rate or volume limits, and destinations it may contact.
- Human approval points for high-impact or irreversible actions.
- Logging, alerting, test evidence, review frequency, and shutdown procedure.
- Launch date, expiry or reassessment date, and retirement owner.
Least privilege and scoped tools
Give an agent only the data and tools required for its stated task. Prefer read-only access where writing is unnecessary. Separate development, test, and production credentials. Restrict records by business unit, customer, geography, or case where the task permits. Do not give an agent a broad administrator token simply because the integration is easier.
Human confirmation for consequential actions
Require a person to confirm actions that can release funds, change access, delete records, send external communications, make employment decisions, alter production systems, or create legal or regulatory commitments. The confirmation screen should show the proposed action, affected objects, destination, and relevant evidence. “Human in the loop” is meaningful only when the reviewer can understand and stop the action.
Autonomy tiers
| Tier | Typical capability | Data sensitivity | Action control | Audit expectation |
|---|---|---|---|---|
| 1. Drafting | Answers or drafts without business connectors. | Public or low-risk internal data. | User reviews before use. | Prompt and output handling rules; ordinary account logs. |
| 2. Retrieval | Reads approved files or systems. | Internal or limited confidential data. | No writes; scoped user permissions. | Connector, query, and access logs with periodic review. |
| 3. Assisted action | Prepares changes, messages, or transactions. | Confidential or operational data. | Explicit human confirmation for each consequential action. | Immutable action record, reviewer identity, and exception alerts. |
| 4. Bounded automation | Performs pre-authorized repetitive actions. | Only data approved for the workflow. | Strict limits, allowlists, rollback, and automatic shutdown triggers. | Continuous monitoring, periodic security assessment, and owner recertification. |
CISA and partner agencies, in guidance announced May 1, 2026, recommend limiting agent autonomy and avoiding broad or unrestricted access, especially for sensitive data or critical systems. Use threat modeling, layered defenses, strong identity management, oversight, continuous monitoring, and recurring security assessments rather than trusting a single prompt filter.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Review third-party agents before connection
Require reviewers to inspect an agent’s privacy statement and terms and determine exactly which organizational data it can reach. Microsoft’s Copilot guidance specifically advises checking those terms for agents added to Copilot. Record whether the agent can retain prompts, use data to improve its service, share data with subprocessors, transfer it across regions, or allow its operator to access content.
Do not approve an agent merely because it appears inside an approved platform. A third-party connector can introduce separate retention, identity, security, and support conditions. Reassess the approval when the agent, connector, scope, provider terms, or data classification changes.
Separate personal-device (BYOD) rules from account rules
An employee can use a company account on a personal phone, or a personal account on a company laptop. Each combination creates different risks. NIST states in its September 28, 2023 SP 1800-22 publication abstract: “An ineffectively secured personal mobile device could expose an organization or employee to data loss or a privacy compromise.” NIST’s BYOD guidance treats organizational security and employee privacy as paired concerns.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall| Decision area | BYOD access | Managed corporate device |
|---|---|---|
| Employee privacy | Requires clear notice about what work-management tools can see or change; avoid collecting personal content. | Still requires notice, but work and personal use can be separated more consistently. |
| Data separation | Use managed work containers, browser profiles, or application controls where suitable. | Use enterprise profiles, storage, and endpoint policies. |
| Device posture | Require supported OS versions, encryption, screen lock, updates, and threat protection before access. | Enforce centrally through endpoint management. |
| Revocation | Be able to remove work access and work data without wiping personal data, where technically and legally appropriate. | Remote lock, wipe, and account disablement are generally easier to administer. |
| Support burden | More device diversity and troubleshooting responsibility. | Standardized hardware and software reduce variation. |
BYOD conditions to state explicitly
- Which approved AI services may be accessed from a personal device.
- Required screen lock, encryption, operating-system support, updates, and malware protection.
- Whether a managed work profile, application protection, virtual desktop, or browser isolation is required.
- What administrators can see, enforce, block, remove, or log, and what remains private.
- How lost, stolen, rooted, jailbroken, or noncompliant devices are handled.
- How work access ends when employment, contract, device compliance, or the exception ends.
Consult privacy leadership and counsel about monitoring notices, employee-consultation duties, works councils, cross-border transfers, and sector requirements. This policy is general security guidance, not jurisdiction-specific legal advice.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Identity, access, and enforcement controls
Turn the policy into technical conditions wherever the service supports them. Microsoft Entra guidance gives multifactor authentication and device compliance as examples of access conditions for generative-AI environments.
- Use single sign-on and the designated work identity for approved services.
- Require multifactor authentication appropriate to the risk; consider phishing-resistant methods for administrators and high-impact workflows.
- Condition access on device compliance, location, risk, or managed application status where justified.
- Use groups and role-based access to limit who can create, connect, publish, or administer agents.
- Review user, service-account, connector, and agent permissions on a defined schedule and after role changes.
- Log sign-ins, prompt or data-access events where available, tool calls, approvals, configuration changes, and administrative actions.
- Alert on personal-account use for corporate domains, prohibited uploads, unusual exports, privilege escalation, and attempts to disable logging.
- Provide a rapid way to revoke tokens, disable connectors, quarantine an agent, and preserve relevant evidence.
Enforcement should be proportionate and published. Explain which events trigger coaching, temporary suspension, formal investigation, or disciplinary action, while allowing for accidental disclosure and prompt reporting.
Incident response and employee reporting
If an employee used a personal account by mistake
- Stop further prompts, uploads, sharing, and connector activity immediately.
- Report the service, account, time, data involved, recipients, and screenshots or logs to the designated security or privacy contact.
- Do not attempt to conceal or delete evidence. Preserve the prompt and output according to incident instructions.
- Security and privacy teams assess exposure, provider deletion options, contractual and legal duties, and whether credentials or tokens must be rotated.
- Record corrective actions, such as access blocking, training, data-subject notification, or policy changes.
If an agent behaves unexpectedly
- Use the documented shutdown or connector-revocation procedure.
- Preserve action logs, approvals, inputs, outputs, and configuration versions.
- Check whether the agent reached data or systems outside its registered scope.
- Require owner and security review before re-enabling it; retest permissions and guardrails.
Implementation sequence for the policy owner
- Inventory current use. Identify services, personal and work accounts, agents, browser extensions, connectors, devices, data flows, and informal workarounds. Consult security, IT, privacy, procurement, HR, and employee representatives where applicable.
- Choose the permitted route. Assign an approved service and account for each legitimate work use. If personal accounts are not approved, say so plainly and provide a work-account alternative.
- Map classifications. Define allowed and prohibited inputs, outputs, retention, sharing, and connector behavior for every data class.
- Register action-taking agents. Assign owners, scope permissions and tools, require confirmation for high-impact actions, enable logging, and document shutdown and rollback.
- Configure access controls. Apply SSO, MFA, device-compliance conditions, groups, data-loss controls, and alerts where the platform supports them.
- Publish and train. Give employees examples of safe and unsafe prompts, the exception route, help contact, incident channel, and BYOD privacy notice. Train managers so they do not instruct staff to bypass the rule to meet a deadline.
- Review on change. Reassess when a service, connector, regulation, contract, data use, threat assessment, or autonomy level changes. Set a recurring review date even when nothing appears to have changed.
Examples employees can apply
Allowed example
An employee uses the approved work account to ask an authorized drafting assistant to rewrite a public announcement. The prompt contains no confidential planning details, personal information, credentials, or unpublished figures. The employee checks the output and follows the normal publication review.
Not allowed example
An employee copies a customer complaint containing names and account details into a free personal chatbot to obtain a faster summary. The service and account are not approved, and the information is personal and customer data. The employee must use the approved work workflow or request an exception before processing it.
Agent requiring registration
A support agent reads ticket data, drafts replies, and can send messages. Register its owner, ticket connector, allowed queues, recipient limits, logging, and human-send approval. A later request to let it close tickets or issue refunds is a scope and autonomy change requiring review, not a minor configuration tweak.
What to measure and when to revise
Track practical indicators rather than claiming that a policy is effective because employees clicked “I agree.” Useful measures include the percentage of approved services using work identities, unresolved personal-account detections, agent inventory completeness, overdue access reviews, connector-scope exceptions, high-impact actions with recorded approvals, training completion, incident-reporting time, and time to revoke an agent.
Review the policy after a material incident, a new connector, a provider-term change, a major model or agent capability change, a new regulation, or a change in the organization’s data classification. Keep a version number, owner, approval date, and next review date on the published document.
Recommended Free Tools
Quick Recap
Policy checklist
- Approved services and required work accounts are named.
- Personal-account use for work is prohibited by default, with a documented exception path.
- Assistant, connected agent, and action-taking agent are distinguished.
- Data classes, prohibited inputs, output handling, retention, and service-improvement settings are addressed.
- Every agent has an owner, purpose, inventory record, scoped connectors, least privilege, logs, review date, and revocation method.
- High-impact actions require meaningful human confirmation.
- BYOD access, device requirements, work/personal separation, visibility limits, and lost-device response are explicit.
- SSO, MFA, device compliance, access reviews, monitoring, and incident reporting are assigned to responsible teams.
- Employees know how to request approval, obtain help, report mistakes, and stop an agent.
- Privacy, employment, consultation, regulatory, and sector requirements are reviewed for each jurisdiction.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
