All controls within the F5 SurePath AI platform are driven by admin-defined policy. SurePath AI tenants use two types of policy: the Default Policy, which applies to all members of a tenant, and Group Policy, which applies to a specific group of users within a tenant.

Together, these policies control which GenAI sites users can access, which sensitive data entities are monitored, which MCP tools are available to GenAI applications, and which intent topics are monitored.

Without SurePath AI, organizations have no way to see how the workforce uses GenAI or where policy violations occur. Because of this, when a tenant is first deployed, SurePath AI configures it in Monitor mode by default. This allows admins and security stakeholders to capture usage data and evaluate the risks occurring within the organization.

Workforce interactions with GenAI services are monitored, and violations are logged without altering the user experience. This mode generates data about GenAI use within the organization, which admins can use to define the first iterations of policy. When an organization is ready to apply policy, admins can toggle the Default Public Service Action setting from Allow - Monitor to Allow - Protect to Block at either the default or group policy level, and SurePath AI applies the defined policy.

In addition to the Default Public Service Action setting, admins can explicitly block specific services using the Service Block List. This feature is available in both the Default Policy and Group Policies, providing granular control over which services are blocked for users.

The Service Block List operates with the following behaviors:

This feature allows organizations to maintain a permissive default service action while still preventing access to specific services. For example, admins can set the default service action to Allow - Protect to allow access to most GenAI services while explicitly blocking specific services that are not approved for organizational use.

SurePath AI, like other security products, practices a least privilege approach to the workforce use of GenAI. Because of this, administrators must add access to all resources that SurePath AI protects using the default and group policies. These policies govern the use of public services.

Group policies can only be used to provide additional access and lessen restrictions on users. This means that users can be members of multiple group policies, each of which can add additional access to the user.

The Services tab controls which public GenAI services users can access and what happens when access to a service is blocked. Admins can build an allowed list of services, block specific services regardless of the default service action, and configure how blocked access attempts are handled.

Allows specific public GenAI services like ChatGPT, Claude, or Microsoft Copilot for users in this policy.

Blocks specific services regardless of the default service action setting. Services in the block list are always blocked, even when the default service action is set to Allow - Monitor or Allow - Protect.

When a user attempts to access a blocked service, the Service Block Action determines what happens next. Admins choose one of two options. A no-access page tells the user they aren't permitted to access the site or service. Redirect to URL sends the user to a customer-defined URL, usually either an approved GenAI service or the organization's acceptable use policy.

SurePath AI discovers MCP Tools by monitoring MCP usage in AI tools across the workforce. SurePath AI intercepts MCP payloads and removes tools that are either blocked by policy or in violation of capability requirements, such as tools that are not read-only. When a tool violates policy, SurePath AI removes it from the MCP payload before sending the payload to the backend service, so the service cannot use that tool.

Explicitly blocks specific MCP tools that have been discovered in the environment. Blocked tools are removed from MCP payloads before they reach backend services.

Explicitly allows specific MCP tools that have been discovered in the environment. Allowed tools will always be included in MCP payloads.

When enabled, automatically allows all read-only MCP tools without requiring them to be added to the Allow List. Because of this, admins do not need to add each read-only tool to the Allow List individually.

Determines the default action taken for MCP tools that are not explicitly allowed or blocked. This setting provides control over how the system handles tools that fall outside of the defined block and allow lists.

The Sensitive Data tab includes Content Controls and PII Detection settings that monitor, redact, or block sensitive information in requests to public GenAI services. For detailed information about Content Controls (High-risk Request, Confidential Data, Programming Language, Harmful Content, Prompt Injection) and PII Detection Settings, refer to the Sensitive Data policy documentation.

Inspect requests for risky patterns such as harmful content, prompt injection, high-risk heuristics, code, and potential confidential data. Available actions include Monitor, Warn, Tag, Mask, Delete, and Block depending on the control type.

Enable or disable detection of personally identifiable information in requests to public services, and choose a global action that applies to all enabled PII entities.

Select specific types of personally identifiable information to detect, such as Phone Number, Credit Card, Email Address, Social Security Number, and others. Entities can be filtered by compliance framework including GDPR, CCPA/CPRA, PCI/DSS, HIPAA, GLBA, and FERPA.

Intent Topics allow organizations to create custom categories of prompts to monitor or block within their environment. For example, an organization might want to monitor for prompts that involve medical diagnostics or gambling and ensure that those prompts are blocked on organization systems. This capability allows organizations to tailor policy to their specific vertical or business needs.

Creating an Intent Topic requires a list of 50 to 200 sample prompts that represent the category, and generating these samples with GenAI is recommended. The sample prompts are turned into vector embeddings, which allows SurePath AI to quickly match user prompts against the customer-defined intent topics.

Choose which action is taken when a GenAI request matches a defined intent topic. Actions can include Monitor, Warn, or Block depending on the sensitivity of the topic and organizational requirements.

The SurePath AI default policy applies to all users in a SurePath AI tenant. The default policy should be the most restrictive policy granting access to only services or resources that have been approved to the entire organization. Group policies should be used to provide access to services and resources to targeted groups of users.

If the organization has approved all users for access to a specific GenAI site, like Microsoft Copilot, adding it to the Default Policy makes the most sense, since all users gain access to services and resources from the Default Policy. Another valid configuration is to allow no access to any services or resources by default.

Group Policies are used to add or allow additional access to services and/or resources over what is granted via the Default Policy. Group Policies are applied to users by associating a group (either manually created or imported via the Directory Sync feature) to a SurePath AI Group Policy.

Group policies are additive and a user can have multiple group policies applied at the same time. Group Policies contain the same settings as the Default Policy, applied to a more specific set of users.

Sensitive Data settings are also built from least restrictive to most restrictive. Because Group Policies are additive and can only add access or reduce restrictions, if Sensitive Data settings are disabled in the Default Policy, admins cannot enable or change them in Group Policy, since the Default Policy must be more restrictive than Group Policy.

Admins must implement the most restrictive Sensitive Data settings at the Default Policy level. Exceptions can then be made within Group Policy to allow or lessen the action for detecting sensitive data.

For example, admins can exempt a group of users from phone number monitoring by disabling the PII entity for phone numbers in that group's Group Policy. This exception is only available if the Default Policy has the sensitive data setting enabled; if it is disabled at the Default Policy level, no change can be made in Group Policy.

Add Microsoft Copilot to the Default Policy of the organization.

Add ChatGPT to the Group Policy that is assigned to the group of users that require the access.

Enable the desired PII entities in the PII Detection settings and set the Action to Delete

Set the PII Detection settings to Log only

NOTE: Since group policies can only allow access or reduce restrictions, in this example, the Block action won't be an option in the group policy settings, only actions that are less restrictive can be selective.

Enable the URL PII entity

Disable the URL PII entity

NOTE: Since group policies can only allow access or reduce restrictions, in this example, PII entities can only be disabled in group policies. PII entities that are not enabled in the Default Policy can not be enabled in a group policy.

This use case demonstrates using the Service Block List to prevent access to specific services while maintaining a permissive default service action.

Set the Default Public Service Action to Allow - Protect to allow access to most GenAI services with data protection enabled. Add specific services like DeepSeek, Grammarly, and Grok to the Service Block List to prevent access to these services.

Set the Service Block Action to Redirect to URL to guide users to approved alternatives when they attempt to access blocked services.

Users will have access to most GenAI services with data protection applied, but attempts to access DeepSeek, Grammarly, or Grok will be blocked and users will be redirected to that URL. This approach allows organizations to maintain broad access while preventing use of specific unapproved services.

This use case demonstrates how the additive nature of the Service Block List allows admins to block services broadly while making exceptions for specific groups.

Add a specific service to the Service Block List to block it for all users by default.

For the group that needs access to the blocked service, do not add the service to the Service Block List in the group policy. Instead, add the service to the Allowed Services list.

Most users will have the service blocked, but users in the specific group policy will have access. However, note that since block lists are concatenated, if the service is in the Default Policy block list, it will be blocked for all users regardless of group policy settings. To enable service-level exceptions, admins should use the Block default service action and manage access through the Allowed Services lists instead of the Service Block List.

This use case demonstrates how to use MCP tool controls to allow safe read-only operations while preventing potentially risky tool usage.

Navigate to the MCP Tools tab in the Default Policy. Enable the Allow Read-only toggle to automatically permit all read-only MCP tools. Add specific high-risk tools to the MCP Tool Block List, such as tools that provide file system access, web scraping capabilities, or external API calls that could exfiltrate data. Set the Catch-all Action to Monitor to observe tools that fall outside of the block and allow lists.

Read-only MCP tools will work automatically without requiring manual approval, reducing administrative overhead while maintaining security. High-risk tools added to the block list will be removed from MCP payloads before reaching backend services, preventing their use. The Monitor action on uncategorized tools provides visibility into tool usage patterns, allowing admins to refine their block and allow lists over time based on actual usage.

The policy that is being applied to a user can be verified using the admin interface at https://admin.surepath.ai: