Secure Web Gateway

Control AI app access
without blocking work

Set allow, warn, block or monitor rules for supported AI apps, categories and domains. Route legitimate exceptions for review.

Request an AI Security Assessment ← Back to SaaS AI

Rule actions: allow, warn, block, monitor

<5min

Policy propagation to all endpoints

Target types: app, category, domain

100%

Offline enforcement — cached policy

Rule Engine

First-match wins.
Priority-ordered, always.

Every AI app access decision evaluates rules in priority order and stops at the first match. Predictable, auditable, and easy to reason about — even with hundreds of rules.

Block — hard stop, block page shown with exception link

Warn — user sees warning, can acknowledge and proceed

Allow — access granted, event logged silently

Monitor — allow access and log all activity for later review

Three target types — catalog_app for named apps, category for bulk app groups, and domain for exact or glob-pattern URL matching.
Per-rule hit counts — see exactly how many times each rule has fired in the last 7, 30, or 90 days. Zero-hit rules are surfaced by the AI Review drawer.
User & group scoping — restrict any rule to specific users, groups, or directories synced via SCIM. The same app can be blocked for one team and allowed for another.
AI Review drawer — client-side analysis flags catch-all allows overriding blocks, rules with zero hits, and rules with duplicate targets. Fix policy drift in one click.

#	Rule Name	Target	Action	Hits (30d)
10	Block DeepSeek	deepseek	Block	47
20	Block AI image tools	AI Image Gen	Block	12
50	Warn unsanctioned AI	AI Tools	Warn	214
100	Allow ChatGPT	chatgpt	Allow	4,291
110	Allow Claude	claude	Allow	1,832
500	Monitor all AI tools	AI Tools	Monitor	988

Exception Request Workflow

Blocked users request access.
Admins approve in one click.

When a user is blocked from an AI app, they see a branded block page with a "Request Access" button. Their justification reaches the admin console immediately — no email chains or ticket queues.

User hits a block rule. The AIGuard block page displays with an explanation and a "Request Access" button. The user enters a brief business justification before submitting.

Request appears in the admin console. The security team sees the user, the app they requested, the blocking rule, and the justification. No email required.

Admin approves or denies. If approved, the admin can grant access for a defined period (1 hour, 1 day, 7 days, or permanent). Optional expiry ensures temporary exceptions don't become permanent shadow AI.

User is notified and access is granted. The exception is recorded in the audit log with the approver's identity, reason, and expiry. When it expires, the block rule re-activates automatically.

j.sharma@acme.com

Requested: Perplexity · 12 min ago

Pending

"Need to research competitors for the Q4 strategy deck — just for today."

l.chen@acme.com

Requested: Midjourney · 44 min ago

Pending

"Creating marketing assets for the product launch next week."

How It Works

SWG enforcement in four steps

User navigates to an AI app

The AIGuard browser extension detects the request. It identifies the app against the catalog (or matches the domain against glob rules) and retrieves the locally cached policy bundle.

Rules evaluated in priority order

Each active rule is checked in ascending priority order. The first rule whose target matches the app and whose scope matches the user fires — its action is executed immediately. No other rules are evaluated.

Action enforced at the browser

Block rules show the AIGuard block page with an optional exception request link. Warn rules inject a dismissible banner. Allow and Monitor rules are transparent to the user. The hit count for the matching rule increments in the console.

Events logged and surfaced

Every access decision is logged with user, device, app, rule matched, action taken, and timestamp. Blocked events with exception requests appear in a dedicated queue for admin review. All events are available via the REST API for SIEM integration.

Capability Comparison

AIGuard SWG vs. traditional web filters

Capability	AIGuard SWG	Traditional Web Filter	DNS Filter	SASE / SSE
AI app catalog (200+ apps)	✓	URL only	—	Partial
Priority-ordered first-match rules	✓	✓	—	✓
Exception request workflow	✓ Built-in	—	—	3rd-party
Hit-count tracking per rule	✓	Aggregate only	—	Limited
AI Review — zero-hit rule detection	✓	—	—	—
Offline enforcement	✓ Cached policy	Cloud-dependent	—	VPN required
Glob domain matching	✓	✓	✓	✓
User & group scoping	✓	Limited	—	✓

FAQ

Common questions

The user sees an AIGuard block page explaining why access was denied and which policy triggered the block. They can optionally click "Request Access" to submit a business justification. The request routes to the security team's exception queue in the console — no email or help-desk ticket needed. Once approved, access is granted instantly for the period the admin specified.

The browser extension subscribes to a push channel and receives rule changes in real time — usually within seconds of saving a rule. The forward proxy refreshes its policy bundle every 5 minutes. For urgent situations (e.g., immediately blocking a newly discovered app), you can force-push from the console and all agents pick up the change within 30 seconds.

Yes. Rules support user and group scoping synced from your directory via SCIM. A common pattern: create a high-priority "Allow" rule scoped to your security research team, then a lower-priority "Block" rule covering the same app for everyone else. Because rules are evaluated in priority order and stop at the first match, the research team's allow fires first.

The AI Review drawer is a client-side policy analysis tool that runs in your browser. It scans your current SWG ruleset and flags: catch-all "Allow" rules that override later "Block" rules (ordering conflict), rules that have zero hits in the last 30 days (likely dead rules), and rules with duplicate or overlapping targets. All analysis runs locally — no rule data is sent to an external AI service.

The forward proxy enforces SWG rules at the network level for devices without the extension — useful for unmanaged devices or BYOD. However, exception request workflows and hit-count attribution require the extension. We recommend the extension for all managed devices and the proxy as a complementary control for network-level coverage.

Control AI app accesswithout blocking work

First-match wins.Priority-ordered, always.

Blocked users request access.Admins approve in one click.