aiwatch AI usage inventory and inline policy
Sample data, synthetic tenants

Halcyon Health (sample)

Every AI tool this organisation's people touched, built from browser and desktop sensor events. Each event is deduplicated on its id within this tenant, checked against the tenant's policy inline, and answered with allow, coach or block before the sensor releases the action.

12
AI apps discovered
9
not on approved list
1276
events ingested
89
retries deduplicated
510
coached in the moment
66
blocked

AI application inventory 12 apps, sorted by interventions

ApplicationStatusRetention riskUsersPromptsPastedUploadsOAuthCoachedBlockedLast seen
ChatGPT (consumer)
OpenAI · Chat assistant
Unapproved high 42 76 365.5 KB 14 5 166 12 1h ago
Copilot (consumer)
Microsoft · Chat assistant
Unapproved high 35 36 74.0 KB 11 2 80 6 1h ago
Otter.ai
Otter.ai · Meeting notes
Unapproved high 38 28 175.1 KB 11 3 68 11 1h ago
QuillBot
Learneo · Writing
Unapproved high 31 18 229.9 KB 5 4 52 6 1h ago
Gemini
Google · Chat assistant
Unapproved high 33 25 167.7 KB 6 2 51 6 1h ago
Elicit
Elicit · Research and search
Unapproved medium 26 16 83.0 KB 2 5 28 6 1h ago
Canva Magic Studio
Canva · Image and video
Unapproved medium 31 17 158.5 KB 7 2 27 6 1h ago
Hugging Face Spaces
Hugging Face · Model API console
Unapproved high 22 9 4.7 KB 2 3 23 5 1h ago
medscribe-ai.example.io
Unknown · Unclassified
Unapproved high 16 15 32.4 KB 2 6 15 8 1h ago
Microsoft 365 Copilot
Microsoft · Chat assistant
Approved low 44 177 1001.5 KB 57 23 0 0 1h ago
Tabnine
Tabnine · Code assistant
Approved low 38 47 342.3 KB 11 0 0 0 1h ago
Fathom
Fathom · Meeting notes
Approved medium 36 37 238.3 KB 6 5 0 0 1h ago

Sensor traffic

About 8% are replays of earlier event ids, the way a sensor retries after a dropped connection. They are answered with the original decision and never counted twice.

Policy evaluator latency last 1276 decisions

40 nsp50
101 nsp99
250.0 µsbudget
0 decisions over budget. Rules compile into a lookup table keyed by event type, approval status and risk tier, so evaluation does no allocation.

Recent interventions

  • coachElicit · visit
    quinn.e@halcyon.example · coach-visit-unsanctioned
  • coachChatGPT (consumer) · prompt
    tara.d@halcyon.example · coach-large-prompt-unsanctioned
  • coachElicit · visit
    ava.g@halcyon.example · coach-visit-unsanctioned
  • coachChatGPT (consumer) · upload
    liam.l@halcyon.example · coach-high-retention-prompt
  • coachCopilot (consumer) · upload
    rosa.g@halcyon.example · coach-high-retention-prompt
  • coachCanva Magic Studio · visit
    farid.w@halcyon.example · coach-visit-unsanctioned
  • coachChatGPT (consumer) · prompt
    dev.s@halcyon.example · coach-large-prompt-unsanctioned
  • coachCopilot (consumer) · prompt
    maya.n@halcyon.example · coach-high-retention-prompt
  • coachCopilot (consumer) · visit
    uma.b@halcyon.example · coach-visit-unsanctioned
  • coachChatGPT (consumer) · visit
    rosa.g@halcyon.example · coach-visit-unsanctioned
  • coachChatGPT (consumer) · visit
    rosa.h@halcyon.example · coach-visit-unsanctioned
  • coachChatGPT (consumer) · visit
    quinn.e@halcyon.example · coach-visit-unsanctioned
  • blockHugging Face Spaces · oauth_grant
    wen.b@halcyon.example · block-broad-oauth-unsanctioned
  • coachElicit · visit
    uma.b@halcyon.example · coach-visit-unsanctioned
  • coachChatGPT (consumer) · visit
    tara.d@halcyon.example · coach-visit-unsanctioned
  • coachQuillBot · visit
    kemi.i@halcyon.example · coach-visit-unsanctioned
  • coachHugging Face Spaces · visit
    uma.b@halcyon.example · coach-visit-unsanctioned
  • blockOtter.ai · upload
    quinn.e@halcyon.example · block-sensitive-upload-unsanctioned
  • coachOtter.ai · visit
    uma.n@halcyon.example · coach-visit-unsanctioned
  • coachChatGPT (consumer) · prompt
    tara.d@halcyon.example · coach-high-retention-prompt
  • coachGemini · visit
    maya.b@halcyon.example · coach-visit-unsanctioned
  • coachCopilot (consumer) · visit
    maya.k@halcyon.example · coach-visit-unsanctioned
  • coachChatGPT (consumer) · prompt
    uma.b@halcyon.example · coach-high-retention-prompt
  • coachHugging Face Spaces · prompt
    olga.r@halcyon.example · coach-high-retention-prompt
  • coachHugging Face Spaces · visit
    kemi.i@halcyon.example · coach-visit-unsanctioned
  • coachQuillBot · upload
    tara.a@halcyon.example · coach-high-retention-prompt
  • coachCopilot (consumer) · prompt
    wen.b@halcyon.example · coach-large-prompt-unsanctioned
  • coachCopilot (consumer) · visit
    olga.r@halcyon.example · coach-visit-unsanctioned
  • coachQuillBot · prompt
    uma.b@halcyon.example · coach-high-retention-prompt
  • coachQuillBot · visit
    jonah.s@halcyon.example · coach-visit-unsanctioned
  • coachGemini · visit
    rosa.i@halcyon.example · coach-visit-unsanctioned
  • coachCopilot (consumer) · visit
    quinn.p@halcyon.example · coach-visit-unsanctioned
  • coachCanva Magic Studio · visit
    ava.g@halcyon.example · coach-visit-unsanctioned
  • coachCopilot (consumer) · prompt
    sam.r@halcyon.example · coach-high-retention-prompt
  • coachOtter.ai · prompt
    quinn.e@halcyon.example · coach-high-retention-prompt
  • blockGemini · upload
    jonah.s@halcyon.example · block-sensitive-upload-unsanctioned
  • blockGemini · upload
    olga.r@halcyon.example · block-sensitive-upload-unsanctioned
  • blockOtter.ai · upload
    liam.l@halcyon.example · block-sensitive-upload-unsanctioned
  • coachOtter.ai · prompt
    quinn.e@halcyon.example · coach-high-retention-prompt
  • coachCopilot (consumer) · visit
    tara.a@halcyon.example · coach-visit-unsanctioned
  • blockmedscribe-ai.example.io · oauth_grant
    olga.r@halcyon.example · block-broad-oauth-unsanctioned
  • coachHugging Face Spaces · prompt
    wen.b@halcyon.example · coach-high-retention-prompt
  • coachQuillBot · visit
    rosa.g@halcyon.example · coach-visit-unsanctioned
  • coachHugging Face Spaces · visit
    kemi.i@halcyon.example · coach-visit-unsanctioned
  • blockQuillBot · upload
    olga.r@halcyon.example · block-sensitive-upload-unsanctioned
  • coachGemini · visit
    ava.g@halcyon.example · coach-visit-unsanctioned
  • blockChatGPT (consumer) · oauth_grant
    maya.b@halcyon.example · block-broad-oauth-unsanctioned
  • coachOtter.ai · prompt
    quinn.p@halcyon.example · coach-high-retention-prompt
  • coachChatGPT (consumer) · visit
    grace.t@halcyon.example · coach-visit-unsanctioned
  • blockCanva Magic Studio · oauth_grant
    maya.n@halcyon.example · block-broad-oauth-unsanctioned
  • coachCopilot (consumer) · prompt
    grace.m@halcyon.example · coach-high-retention-prompt
  • coachGemini · visit
    tara.d@halcyon.example · coach-visit-unsanctioned
  • coachCanva Magic Studio · visit
    uma.n@halcyon.example · coach-visit-unsanctioned
  • coachOtter.ai · visit
    kemi.f@halcyon.example · coach-visit-unsanctioned
  • coachChatGPT (consumer) · visit
    uma.w@halcyon.example · coach-visit-unsanctioned
  • coachOtter.ai · prompt
    maya.n@halcyon.example · coach-high-retention-prompt
  • coachChatGPT (consumer) · visit
    ava.g@halcyon.example · coach-visit-unsanctioned
  • coachGemini · visit
    olga.r@halcyon.example · coach-visit-unsanctioned
  • coachChatGPT (consumer) · visit
    rosa.g@halcyon.example · coach-visit-unsanctioned
  • coachCopilot (consumer) · prompt
    sam.r@halcyon.example · coach-high-retention-prompt

Active policy first match by severity: block, then coach, else allow

blockblock-sensitive-upload-unsanctioned

On upload to unapproved apps; risk tier medium or higher; data or secret file type.

"Uploading data files to an unapproved AI tool is blocked. Use {alt} instead."

blockblock-broad-oauth-unsanctioned

On oauth_grant to unapproved apps; mail, file or code scopes.

"This app asked for access to mail, files or code. Grants to unapproved AI apps are blocked."

coachcoach-large-prompt-unsanctioned

On prompt to unapproved apps; content at least 4.0 KB.

"That is a large paste into an unapproved tool. {alt} is approved for this and keeps your data out of training."

coachcoach-high-retention-prompt

On prompt, upload to any app; risk tier high or higher.

"This tool may retain or train on what you submit. Leave out customer data, or switch to {alt}."

coachcoach-visit-unsanctioned

On visit to unapproved apps; risk tier medium or higher.

"This AI tool is not on the approved list. {alt} covers the same job."

Sensor ingest API

curl -s https://aiwatch.levelbrook.com/v1/events \
  -H 'Authorization: Bearer sk_demo_halcyon' \
  -d '{"id":"evt_demo_001","user":"ava.k@halcyon.example","sensor":"browser",
       "type":"upload","domain":"chat.deepseek.com","file_ext":"csv","content_bytes":482113}'
The tenant comes from the sensor key, never from the body; a body that names another tenant is refused with 403. Prompts arrive as a SHA-256 of redacted content plus a size, and the decoder rejects unknown fields, so raw prompt text cannot be stored by accident. Send the same id twice and the second call returns "status":"duplicate" with the original decision.