AI Policies

The Policies page is where you view your AI posture policies.

Use this page to see the predefined policies that determine which posture findings Tenable One AI Exposure and AISPM generate. You can also filter, customize the table, and drill into a specific policy's details.

Policies are grouped into the following categories:

  • Data
  • Excessive access
  • Insufficient encryption
  • Missing observability
  • Risky Tools

Manage Policies

To view and manage policies:

  1. In the AI Exposure Console, click Policies.
  2. Select an account scope in the Organization dropdown to enable/disable a policy on a specific subset of cloud accounts. By default, the entire Organization (all accounts) is selected.
  3. Filter the table to narrow the scope of the visible data. Use the column picker on the top right of the table to choose which columns to display. See Policy Column Data for more information.
  4. In the row of the policy, click the three-dots icon and select Edit.
  5. Click a policy to open a slideout panel that contains more information and click the three-dots icon and select Edit.
  6. Edit the policy configuration to enable or disable the policy.

Policy Column Data

The following columns appear in the table on the Policies page.

Filter Description
Provider The AI service provider. Possible values include: Microsoft Copilot, Google Gemini, OpenAI ChatGPT, or Anthropic Claude.
Category The logical category to which the policy belongs.
Name The name of the policy.
Severity The severity level of the policy, which determines the severity level of any findings triggered by the policy.
Status Whether the policy is enabled or disabled. You can Enable and Disable Policies so that the policies do not trigger findings for resources in those accounts.
Findings The total number of findings triggered by the policy.
Modified By The user identity that modified the policy.
Created By The user identity that created the policy.
Creation Time The time of policy creation.
Policy Settings Three dots menu icon
  • Edit — Click Edit to enable or disable the required policy.

Enable and Disable Policies

By default, out-of-the-box policies are enabled and apply to all accounts in your organization. You can fine-tune this configuration by either disabling a policy across your entire organization, or just for a specific subset of accounts or folders.
See Account Hierarchy and Folders for more information about grouping accounts together using folders.

Caution: Disabling a policy deletes all associated findings in the relevant accounts and prevents new findings from being created. This action occurs after the next data synchronization and is irreversible.
Note: Enabling and disabling policies is only available to users with the Administrator role. Some policies that relate to low-severity issues are disabled by default, but can be enabled if required to achieve compliance or for another security goal.

To enable or disable a policy:

  1. In the AI Exposure Console, click Policies.
  2. Select an account scope in the Organization dropdown to enable/disable a policy on a specific subset of cloud accounts. By default, the entire Organization (all accounts) is selected.
  3. Navigate to the relevant policy.
  4. Click the three dots menu Three dots menu icon and click Edit.
  5. In the Status section, choose a relevant option:
    • Enabled (overrides parent-level configuration). AI Exposure creates findings when policy rules are violated.
    • Disabled (overrides parent-level configuration). AI Exposure does not create findings when policy rules are violated.
  6. Click Save.
Note: If you override the parent-level configuration, the unique configuration remains, regardless of any changes made in the parent-level scope.