AI governance code analysis rule
- Updated: 2024/09/25
AI governance code analysis rule
With the new AI governance code analysis rule, you can ensure responsible and compliant use of AI. Code analysis enhancements allow you to monitor and enforce your AI-use policy via notifications for immediate remediation.
Overview
Using foundational models that have not been tested could pose significant safety risks to users and applications using them. Without the security controls to govern access to the generative AI models the users and applications would be exposed to risks associated with the model use. Implement governance policies that are aligned with your organization's responsible AI and safe usage policies to mitigate these risks. Restrict access to approved and tested models to manage risk when using models that have not been vetted for good response quality, in addition to enforcing rule as per regional restriction.
The new rule enforces model usage during the design and development of automations through code analysis. This easy-to-enforce policy helps ensure compliance before automations are checked-in to the Production folder for execution. The policy checks and reports on automations in Production, that are in violation of the policy and provides visibility into the risk when these compromised and unapproved models are used. This gives you an opportunity to remediate these incidents.
See Code analysis rules and Configure and assign code analysis policy.
Benefits
- Restrict model-use to tested and validated models only
- Monitor violations to the policy
- Prevent code check-ins with policy violations
Users and permissions
The Automation Admin, Pro Developer, or the Automation Lead would be the primary users of the AI governance code analysis policy. They would define the rule for the Bot Creators and Pro Developers to monitor and enforce policy restrictions on the model use and token consumption. The personae can define the policy through the Control Room Policy manager and assign them to folders containing automations.
After developing the automations, when the Pro Developer saves and checks-them in, the policy checks get triggered and notifies them of any policy violations in the automation-code. The Pro Developers must address and resolve the policy violations to complete the code check-in process successfully.
- List of supported hyperscaler publishers
- List of models from the hyperscaler publishers
- Supported regions of deployment
See Code analysis for permission details.
Availability
This feature requires the Enterprise Platform license. For information about supported version for this feature, see Enterprise Platform.
Accessing AI governance code analysis policy
- In the Policies screen, click Create policy or + icon to display the Create policy page with the option to add the Policy details.
- Scroll to the AI Governance policy and enable the toggle.
- Click Add model and begin adding the Publisher which is the hyperscaler vendor, Model which is the supported model from the vendor, and the Region of deployment.
- Clicking the Add model button lets you add a new row in the Allowed models table.
- Next, add the severity level as Critical as per the
code analysis policy.Note: We recommend adding the severity level as Critical to prevent the Pro Developer from checking-in an automation, in case of rule violations.
- Next, save the changes.