When Policy Meets Real Behavior
A government contractor was under pressure. He had a backlog of FEMA flood-relief applications to process. He pasted names, addresses, and health records into ChatGPT to move faster. He broke no laws in his mind. He just used the best tool at hand.
The result: a government investigation and a public disclosure.
This is the core failure of policy-only AI governance. Policies tell employees what to do. They do not stop the behavior.
77% of enterprise employees share sensitive work data with AI tools at least weekly — even when policy prohibits it (eSecurity Planet/Cyberhaven 2025). These are not reckless workers. They are people under time pressure choosing the fastest tool.
Why Policies Break Down
AI use policies rely on human judgment at the point of input. That moment is fast. The employee may not recall the policy. They may not see the content as "sensitive." They may accept the risk because the time savings feel large.
Cyberhaven's Q4 2025 analysis found that 34.8% of all ChatGPT inputs contain confidential business information. Many of those users knew the policy. They pasted anyway.
Access policies work because systems enforce them. DLP at the email layer works because systems apply it. AI use policies have no enforcement at the paste point. A human decision fills that gap. At scale, humans make errors.
The FEMA contractor made one of those errors. He was not a bad actor. The tool won because the policy asked him to choose slowness over speed. Under pressure, he chose speed.
Technical Controls Stop What Policies Cannot
The only fix that works at scale operates at the technical layer — not the training layer.
A browser extension can intercept clipboard content before it reaches any web-based AI. When the contractor copies applicant names and addresses and pastes into ChatGPT, the extension detects the PII, anonymizes it, and sends the clean version. The AI sees [NAME_1] and [ADDRESS_1] instead of real values. It still completes the task. The applicant's private details never reach ChatGPT's servers.
This is automatic. It does not ask the user to remember anything.
For developers using Cursor or GitHub Copilot, an MCP Server provides the same layer. Code pasted into the AI context passes through the anonymization engine first. Credentials and proprietary identifiers become tokens. The AI receives clean input and still gives useful output.
See how this compares to blocking: Blocking vs. Anonymization — Browser DLP Compared.
What Changes With Technical Controls
With a browser extension in place, the FEMA contractor scenario runs differently:
- Contractor copies applicant records from the case system
- Extension detects PII in the clipboard
- A preview modal shows what will be replaced
- Anonymized version goes to ChatGPT
- ChatGPT processes the request and returns results
- Contractor gets the help needed — no investigation triggered
The policy did not need to change. Training did not need to run. The interception layer handled it.
Policy training reduces risk at the margins. Technical controls eliminate the failure mode. The FEMA incident was a policy failure. It would have been a non-event with one Chrome Extension deployed to that contractor's device.
See also:
- Enterprise AI Governance: Chrome Extension DLP
- Browser DLP for ChatGPT, Claude, and Gemini
- Chrome Extension: Browser DLP for AI Tools