F5 SurePath AI classifies user prompts into intent categories for governance and business insight. It provides two classification systems: system-detected intent, which automatically categorizes requests using a standardized taxonomy for analytics and observability, and Custom Intent Topics, which organizations define to enforce policies aligned with their risk posture and business needs. Together, these systems let admins apply precise controls while tracking how teams use AI across the organization.

System-detected intent provides automatic categorization of user requests using a standardized taxonomy that remains consistent across organizations. This built-in classification works immediately without configuration, classifying every request using three complementary dimensions: Domain, Action, and Topic.

The primary value of system-detected intent is business intelligence and observability rather than policy enforcement. Organizations use these standardized categories to understand usage patterns, identify trends, measure adoption across business areas, and make strategic decisions about AI enablement and investment.

System-detected intent describes what users are trying to accomplish using three labels that answer different questions about each request. These categories work together to provide a complete picture of AI usage across the organization.

Domain intent identifies the broad business area or functional department the request relates to. It answers the question "Where does this work belong?" by categorizing requests into areas such as Software Engineering, Human Resources, Finance, Legal, Security, Information Technology, Customer Service, Business Operations, or General. This dimension helps organizations understand which parts of the business are adopting AI most actively, where AI delivers the most value, and how usage patterns differ across departments.

Organizations use Domain intent for business insights such as tracking adoption by department, identifying high-value use cases within specific business areas, and understanding demand signals that inform AI strategy and resource allocation. Even when policy enforcement uses Custom Intent Topics, Domain intent provides useful segmentation for dashboards, reports, and analytics.

Action intent identifies the type of work users want the model to perform. It answers the question "What does the user want done?" by categorizing requests into outcomes such as Analyze, Summarize, Search, Create, Convert, Plan, Review, Translate, Run, Recommend, Brainstorm, or Chat. This dimension reveals how people use AI in their workflows and which types of tasks drive the most value.

Organizations use Action intent to understand usage patterns such as whether teams primarily use AI for content generation versus analysis, which actions appear most frequently in different departments, and where organizations might invest in automation or improved tools to better support common actions.

Topic intent identifies the subject matter or content type the request involves. It answers the question "What is it about?" by categorizing requests into subjects such as Contracts and agreements, Policies and procedures, Technical documentation, Software code and source repositories, Customer records and CRM data, Incident and audit logs, or General. This dimension helps organizations identify what types of information and artifacts users work with when using AI.

Organizations use Topic intent to spot trends such as which subject areas generate the most AI requests, where knowledge gaps might exist that better documentation could address, and what types of content drive the most business value when processed with AI.

System-detected intent uses a predefined taxonomy of values for each category. As SurePath AI evolves and learns from usage patterns across organizations, new values may be added to any of the three categories to provide more granular classification and better coverage of emerging use cases. Organizations should treat these categories as an open set that will expand over time to reflect the evolving landscape of AI usage in enterprise settings.

The key distinction between system-detected intent and Custom Intent Topics lies in who defines the categories and what they optimize for. System-detected intent provides standardized, automatically assigned labels that work across all organizations without configuration. These labels prioritize consistency and comparability, making them valuable for benchmarking, trend analysis, and cross-organizational insights.

Custom Intent Topics, by contrast, are defined by each organization to match their specific policies, risks, and business structure. They require configuration and training but deliver precision for governance and relevance for business-specific analytics. Organizations use Custom Intent Topics when they need to enforce policies or measure usage against categories that matter uniquely to their operations.

Both classification systems run on every request, providing complementary views of AI usage. Organizations typically enforce policies using Custom Intent Topics while using system-detected intent for observability, reporting, and strategic planning.

Custom Intent Topics are organization-defined categories that reflect an organization's policies, risk posture, and business taxonomy. Organizations create these categories to identify and govern specific types of AI requests that matter to their operations, compliance programs, and strategic initiatives.

Custom Intent Topics provide organizations with governance and analytics capabilities tailored to their unique requirements. By defining categories that match internal policies and business structure, organizations gain several advantages over generic classification approaches.

Policy enforcement becomes more precise when organizations can target controls to their specific concerns. Instead of relying on broad categories that may not align with actual risk areas, admins can create intent topics for exactly what they need to govern—whether that's proprietary project names, regulated workflows, customer segments, or internal policy categories. Each custom intent topic can have its own policy action applied in the Default Policy or Group Policies, enabling differentiated controls based on organizational priorities.

Analytics and reporting become more meaningful when measurements align with business categories. Organizations can track AI usage against dimensions that matter to their stakeholders: product lines, compliance programs, team initiatives, or customer segments. This alignment makes it easier to demonstrate value, identify adoption patterns, and make data-driven decisions about AI enablement and governance.

False positives decrease when intent detection targets known patterns. Organizations often have specific terminology, product names, or workflow types that appear frequently in their AI usage. By creating custom intent topics for these patterns and providing example messages, organizations can achieve more accurate detection than generic categories provide.

Organizations implement Custom Intent Topics to address three main categories of governance and observability needs.

Internal policy categories represent what the organization considers sensitive, restricted, or noteworthy according to company policies. Examples include confidential project codenames, merger and acquisition activities, executive communications, personnel matters, or any topic that requires special handling under internal governance frameworks.

Business-specific groupings align intent detection with how the organization structures its operations. These might represent product lines, customer segments, geographic regions, regulatory programs, or strategic initiatives. For example, a healthcare organization might create intent topics for different service lines, while a technology company might create topics for each product family.

Operational signals capture intents that teams want to track for adoption measurement, user enablement, or support planning. These help organizations understand which types of requests are most common, where users need additional training or resources, and how AI usage evolves over time.

Admins create and manage Custom Intent Topics on the Classifiers page, where they appear as the Custom Intent classifier type and show Intent in the Type column. Entity classifiers on the same page match a regular expression instead of meaning. The process involves defining the intent category, providing example messages to train the detection system, and enabling the classifier for use in policies.

To create a new Custom Intent Topic:

After creating an intent topic, admins need to provide example messages that represent the types of prompts users might submit for this category. The system uses these examples to build a semantic understanding of the intent, enabling it to match similar requests even when they use different wording or phrasing.

To add example messages to a Custom Intent Topic:

Example messages should represent diverse ways users might express the same intent. Including variety in length, tone, formality, and vocabulary helps the system recognize the intent across different communication styles and contexts.

Creating high-quality example messages is essential for accurate intent detection. Admins can use AI tools to generate diverse training examples by providing a structured prompt that produces the variety and specificity needed for effective classification.

To generate example messages using an AI assistant, admins can use the following prompt template, replacing [YOUR INTENT/TOPIC HERE] with the specific intent category they want to train:

After generating the example messages, admins should review the output to ensure quality and relevance, then save the messages to a TXT file for upload to the Custom Intent Topic.

Once Custom Intent Topics are created and trained with example messages, admins can apply policy actions to control how the system responds when it detects requests matching those intents. Policy configuration happens in two places: the Default Policy, which applies to all users unless overridden, and Group Policies, which apply to specific user groups.

To configure policy actions for Custom Intent Topics in the Default Policy:

To configure policy actions for Custom Intent Topics in a Group Policy:

Group Policy actions override Default Policy actions for members of the group, allowing organizations to apply differentiated controls based on role, department, risk tolerance, or other group-based criteria.

SurePath AI detects intent at the moment a user submits a prompt to an AI service, before the request reaches the model. This prompt-time detection creates a consistent governance and observability layer that works across all AI services and models the organization uses, regardless of provider or endpoint.

When a request passes through SurePath AI, the system performs several classifications simultaneously. For Custom Intent Topics, the system compares the request against the example messages provided for each enabled intent topic, using semantic similarity to identify matches even when the wording differs from the training examples. For system-detected intent, the system applies its built-in taxonomy to assign Domain, Action, and Topic labels based on the content and structure of the request.

These classifications happen in real time, adding minimal latency to the request flow. The system records all detected intents in activity logs and uses them for two primary purposes: policy enforcement and business intelligence.

When SurePath AI detects that a request matches a Custom Intent Topic with an associated policy action, the system enforces that action before the request reaches the AI model. Depending on the configured action, the system might block the request entirely, present a warning to the user requiring acknowledgment, log the request for audit and review, or allow it to proceed with additional monitoring.

This prompt-time enforcement provides several advantages over post-processing approaches. Organizations can prevent sensitive information from leaving their control rather than detecting it after the fact. Policy decisions remain consistent across all AI services, eliminating the need to configure governance separately for each provider or model. Users receive immediate feedback about policy violations, creating clearer expectations and reducing unintentional violations.

Policy enforcement uses Custom Intent Topics rather than system-detected Domain, Action, and Topic labels because Custom Intent Topics allow organizations to define exactly what they need to govern. While system-detected intent might identify that a request relates to Legal work involving Contract analysis, a Custom Intent Topic can specifically identify requests about merger and acquisition contracts, enabling more targeted controls aligned with company policy.

Both Custom Intent Topics and system-detected intent contribute to business intelligence and observability. Organizations use intent classifications to understand adoption patterns, identify high-value workflows, spot emerging needs, and make strategic decisions about AI enablement.

System-detected intent provides particularly valuable insights for these purposes because its standardized taxonomy allows comparisons across teams, time periods, and business areas. Organizations can answer questions such as which departments drive the most AI usage, how usage patterns evolve over time, which types of requests appear most frequently, and where AI delivers the most measurable value.

Custom Intent Topics add business-specific dimensions to these insights, allowing organizations to measure usage against their own taxonomy. A product organization can track AI usage by product line, a healthcare provider can measure usage by service area, and a regulated company can monitor usage across different compliance programs.

Intent Topics integrate with SurePath AI's policy framework to enable targeted governance based on the content and purpose of user requests. Organizations configure policy actions for Custom Intent Topics through the Default Policy and Group Policies (see Understanding policies), creating differentiated controls that match their risk tolerance and operational requirements. Intent topics also factor into risk scoring — see How SurePath AI assesses risk for details.

The Default Policy establishes baseline controls that apply to all users unless overridden by Group Policies. Admins configure intent-based controls in the Intent Topic Controls section of the Classifiers tab of the Default Policy, selecting actions for each Custom Intent Topic that reflect organizational priorities. Common approaches include blocking highly sensitive topics, requiring warnings for topics that need special consideration, and logging specific topics for compliance and audit purposes.

Group Policies allow organizations to apply different controls based on user attributes such as role, department, or responsibility level. A research team might have permissions to work with proprietary project information that would be blocked for other users. Compliance officers might see warnings for regulated content that requires special handling, while other teams see no restrictions. These differentiated controls provide flexibility while maintaining consistent governance standards.

For detailed information about configuring Default Policy and Group Policies, including available actions, policy precedence, and advanced configuration options, admins should refer to the dedicated policy documentation in the SurePath AI Help Center.