Artificial Intelligence Use Policy

1. Purpose and scope

This policy establishes the mandatory controls for artificial intelligence used by or on behalf of OpenPath, Inc. It applies to employees, contractors, temporary personnel, systems, applications, workflows, and service providers that create, transmit, enrich, summarize, classify, analyze, or act on information using an AI model or agent.

The policy covers generative AI, large language models, machine-learning services, copilots, autonomous or semi-autonomous agents, embedded AI features, and any external model endpoint, whether paid or free.

2. The mandatory AI gateway

The harness is the enforcement boundary between OpenPath systems and an AI service. It authenticates the calling application, applies policy, inspects the request, removes or redacts protected data, and releases only an approved, sanitized payload. A request that cannot be safely sanitized or does not satisfy policy is blocked.

No user interface, plugin, application, automation, or employee may bypass this boundary. The same requirement applies to test, development, support, and production use.

3. Protected information

Before a request can reach an AI model or agent, the OpenPath harness is designed to detect and remove, redact, tokenize, or replace protected information, including:

• Personally identifiable information (PII): information that identifies or can reasonably be linked to a person, such as names, contact details, account identifiers, government identifiers, precise location, or combinations of data that identify an individual.
• Cardholder data (CHD): the primary account number and any associated cardholder name, expiration date, or service code within the meaning of PCI DSS.
• Sensitive authentication data: full track data, card verification codes or values, PINs, PIN blocks, and comparable authentication information. This information is never permitted in an AI-bound payload.
• Credentials and secrets: passwords, authentication tokens, API keys, cryptographic material, private certificates, session identifiers, and other access secrets.
• Confidential business data: customer records, transaction details, contracts, proprietary code, security findings, and internal information unless specifically approved, minimized, and sanitized for the authorized use case.

OpenPath policy requires protected information to be removed before transmission. Sanitization controls are layered with data minimization and default-deny enforcement; requests that fail validation do not proceed to an AI provider.

4. Gated request lifecycle

Authorized AI processing follows a controlled sequence:

• Authenticate and authorize. The harness verifies the calling system, workload identity, permitted use case, and scope.
• Classify and inspect. The request is evaluated for PII, CHD, sensitive authentication data, secrets, confidential information, and prohibited content.
• Minimize and sanitize. Unnecessary fields are removed. Protected values are redacted, tokenized, generalized, or replaced with non-identifying placeholders.
• Enforce policy. The harness blocks requests that cannot be sanitized, originate from an unauthorized source, target an unapproved capability, or violate company policy.
• Transmit through an approved route. Only the sanitized payload is sent through the controlled API connection to an approved AI service.
• Inspect the response. Returned content is subject to output validation and application-specific controls before it is displayed, stored, or used by another system.
• Record the control decision. OpenPath maintains security and operational records appropriate to the use case without intentionally logging raw CHD, sensitive authentication data, credentials, or unredacted PII in AI request logs.

5. Employee and contractor requirements

Personnel may use AI for company work only through OpenPath-authorized applications connected to the company harness. They must:

• use only approved interfaces, accounts, models, agents, and documented use cases;
• provide the minimum information necessary for the task;
• verify AI output before relying on it in code, operations, customer communications, security decisions, financial decisions, or other material work;
• preserve human accountability for decisions and work products;
• follow confidentiality, privacy, security, PCI DSS, intellectual-property, and records-management requirements; and
• report unexpected data exposure, unsafe output, policy bypass, or suspicious AI behavior immediately.

Managers and system owners are responsible for ensuring that authorized workflows remain inside the gated architecture.

6. Prohibited activity

OpenPath personnel and systems must not:

• paste, type, upload, transmit, or otherwise disclose company or customer information directly to a public or private AI model, chatbot, agent, copilot, or model provider;
• use personal AI accounts, unmanaged browser extensions, consumer AI applications, or embedded AI features for company work;
• send PII, CHD, sensitive authentication data, credentials, secrets, or unsanitized confidential information to an AI service;
• disable, evade, modify, or route around the OpenPath harness, its inspection controls, or its logging and authorization requirements;
• connect an AI agent directly to production systems, customer records, payment environments, source repositories, communication systems, or privileged tools;
• allow AI output to execute a privileged or irreversible action without the approvals and deterministic controls required for that system; or
• represent AI-generated output as verified fact without appropriate human or system validation.

7. AI agents and system access

AI agents operate only through scoped OpenPath interfaces. Access to tools, data, or actions must be expressly authorized, limited to the minimum capability required, and mediated by the harness or another approved control plane.

Agents are not granted unrestricted access to production systems, raw payment data, customer databases, secrets, or employee workspaces. Sensitive operations require deterministic authorization, validation, and audit controls outside the model. AI output is treated as untrusted until it passes the controls established for the receiving application.

8. Governance, monitoring, and audit

OpenPath maintains governance over approved AI use cases, model routes, calling applications, and harness controls. Oversight may include access review, configuration review, security testing, redaction testing, request and response monitoring, policy-decision records, vendor review, incident review, and periodic reassessment of authorized use cases.

Control records are designed to support accountability while avoiding the creation of new repositories of raw PII, CHD, sensitive authentication data, or credentials. Access to AI-control telemetry is restricted according to role and business need.

9. Exceptions and change control

There is no exception permitting personnel to send CHD, sensitive authentication data, credentials, secrets, or unredacted PII directly to an AI provider. A new AI use case, model, provider, tool, or data flow requires documented review and authorization before use and must remain behind the OpenPath-controlled harness.

Approved changes follow company security, privacy, engineering, and change-management processes. Emergency conditions do not authorize bypassing the gateway.

10. Incident reporting and response

Any suspected direct AI use, failed redaction, unauthorized model connection, unexpected disclosure, unsafe agent action, or attempt to bypass the harness must be reported immediately through OpenPath security and support channels. OpenPath will investigate, contain, preserve appropriate evidence, remediate controls, and make any legally required notifications.

11. Policy ownership and contact

OpenPath may update this policy as AI technology, company systems, security threats, and legal obligations change. Material changes are reviewed through the applicable governance process.

Questions or concerns about this policy may be sent to support@openpath.io or raised by phone at 844-728-4247. Related privacy practices are described in the Privacy Policy and GDPR and CCPA Privacy notice.