AI rules

AI rules cover connectors that send data to AI services or act through Copilot agents. The category carries a 1.3 multiplier in scoring, between Security (1.5) and Governance (1.0).

AI-03 — AI Connector Unclassified (High)

What it checks. Whether the flow uses an AI-related connector that appears in no DLP policy connector group. The rule has a built-in list of known AI connectors, including shared_openai, shared_azureopenai, shared_cognitiveservices, shared_textanalytics, shared_formrecognizer, shared_speech, shared_translator, shared_vision, shared_customvision, and shared_azureml. It also matches any connector whose name contains “ai”, “openai”, or “cognitive”, so custom or newly released AI connectors are caught too.

Why it matters. AI connectors send your data to models. A connector that sits outside every DLP group has no decided policy behind it, so data can reach an AI service without anyone having approved that path.

What to do. Add the AI connectors to your DLP policy and classify them as Business or Non-Business according to your organization’s AI governance policy.

In 1.2.0. This rule flags every AI connector in every flow — no DLP policy data is collected, so nothing can be classified. Treat hits as a prompt to confirm classification by hand; see Known limitations in 1.2.0.

AI-03 overlaps with DLP-04, the general unclassified-connector rule. The difference is weight: an unclassified AI connector is an AI finding at 1.3, an unclassified ordinary connector is a Governance finding at 1.0, and AI-03 defaults to High where DLP-04 defaults to Medium.

AI-04 — Copilot Excessive Privilege (High)

What it checks. Whether a flow with a Copilot connector also uses high-privilege connectors: shared_sql, shared_sharepointonline, shared_azuread, shared_dynamicscrmonline, shared_salesforce, or shared_http. The finding lists exactly which of these connectors were found alongside the Copilot connector.

Why it matters. A Copilot agent that can reach SQL, SharePoint, Entra ID, Salesforce, or raw HTTP is a prompt-injection and privilege-escalation path. Whoever can prompt the agent can reach those systems through it.

What to do. Scope Copilot agent permissions to least privilege. Put Copilot interactions in separate flows and restrict which connectors those flows can use.

Last updated: July 27, 2026