BusinessGTP firewall user guide (Work In Process)

Overview

The firewall allows the company to monitor and manage the risks of using Generative AI services, focusing on public AI services.

BusinessGPT firewall allows companies to enforce AI policies by analyzing and understanding the use case and user's objectives for using AI.

The firewall safeguards against AI misuse that could pose a risk or violate company policies. It achieves this by understanding the users' objectives for using AI, the relevant content, and the sensitivity/privacy level associated with their activities.

Policies can be applied differently depending on users/groups using it, allowing the maximum benefits of using AI while minimizing the potential risks.

Using a proxy or Browser extension, BusinessGPT gives the company complete visibility and analytics of what the users are doing with AI, whether ChatGPT, Copilot, Gemini, or a custom AI model.

BusinessGPT also offers complete end-to-end Private/ On-prem AI solutions for highly regulated companies, ensuring zero data exposure. You can read more here about this solution here.

The firewall components

All components are visible to the company admin under the Account Firewall section.

The first user who signs into the Dashboard from a specific domain is automatically the account admin. Any other users with the same domain who sign in will be members of that account. You can change this by contacting our support.

Dashboard - The web UI of the product.

Data classification rules—rules classifying data, including the prompt/response and relevant content (documents). Each rule has a sensitivity level.

Usage classification rules- Rules classifying the intention of using the AI services

Firewall Policies- Policies that define each scenario's risk and action (block/ allow/ monitor)

based on groups/users/data classification rules/usage classification rules.

Firewall auditing - Report of all prompts and responses with the policy applied and the matching classification rules

How do you get your prompts into the system?

There are several interfaces available for the system.

Use the system's built-in Chatbot. This works with content you upload to the system but can also work by asking direct questions to the AI services without specific content.
Installing a browser extension (Chrome / Edge). Please go here to learn more TBD. It will soon be available in the marketplace.
Configure NEtwork proxy - contact support for this

Firewall Auditing

Firewall auditing is available at the user or account level.

Firewall actions

The action filed can have the following values:

Allowed —The activity was allowed, but the policies have not yet been validated. This action might change shortly and be monitored if it matches a policy set to monitor.

Allowed —The activity was allowed after validating the policies

Monitored - the activity was allowed but found to match a policy set to “monitor.” This means that this activity should be looked at but not necessarily be at a high risk.

Blocked - the activity was blocked in real time.

Firewall risks

The risks are the results of the matching policies. A full circle represents them

Empty: When no risk is displayed, the policy validation has not yet been done.
None: The Policy validation was completed, but no matching policies were found.
High: The activity matched a high-risk policy
Medium: The activity matched a medium-risk policy
Low(Yellow): The activity matched a low-risk policy

Sensitivity Level

Sensitivity levels are a result of data classification rules.

If data classification is not completed, the system displays a message

A light blue means no matching data classification rules were found. Under the rules, the system writes:

“The content did not match any data classification rules.”

In other classifications, it shows the risk in yellow, orange, and red rings.

When a sensitivity level is set to the activity is blocked regardless of any policy.