AI Policy Enforcement Guide

Overview

The Enforcement feature in AI Policies brings automated, cross-platform control to how Responsible AI (RAI) policies are applied in customer environments. By extending OneTrust’s existing guardrail enforcement capabilities into AWS Bedrock, Azure AI Foundry, and Databricks, customers can now take direct action on AI agents that violate defined policies without relying on manual intervention or platform-specific workarounds. Instead of policies living in disconnected formats, organizations can centrally define governance rules in OneTrust and automatically enforce them across AWS Bedrock, Azure Foundry, and Databricks. This creates a consistent, customer-facing experience where AI risk mitigation is not just observable but actionable in real time.

For more information about managing AI policies, see AI Policies Feature Guide.

To configure the guardrail enforcement

On the AI Governance menu, select AI policies.

The AI policies screen appears.
Click on the name of a policy.

The policy details screen appears.
Go to the Enforcement actions tab.
As new automations are established, cards for enforcement strategies will be displayed. The card titles will reflect the discovered sources.
Click on a tile to open the active guardrails pane.
Click the Add guardrail button to add a new guardrail for the specific system.

Once you choose a project from the selection field, you can then select one of its guardrails.

For Azure Foundry, requires selection of a hub and guardrail from your account
For Amazon Bedrock, requires selection of a region, guardrail, and the version.

For Databricks, apply the settings required for compliance.

Note:

In Databricks, Guadrail settings are directly associated with models or agents.


Guardrail	Description
Input - Safety	Detect and block unsafe or harmful content, such as reference to violent crime, self harm or hate speech.
Input - PII Detection	Detect and block or mask personally identifiable information (PII) Block Mask
Output - Safety	Detect and block or mask personally identifiable information (PII)
Output - PII Detection	Detect and block or mask personally identifiable information (PII) Block Mask

Click the Save button to retain your guardrails.
Go to the Violations tab.
Click on the Context Menu icon for a given violation and then select Apply guardrail.
A side pane will appear for you to choose the guardrail and applicable details according to the system (Foundry vs Bedrock) where the violation originates.
Make your selections, then click the Save and apply button.
Go to the Enforcement actions tab.
Click on the given system tile to review the active guardrail(s) you configured.

To configure automated actions

Important:

The Automated actions feature is under Public Preview. Please contact OneTrust Support to request early access.

AI policy automated actions help reduce manual monitoring and respond to policy violations more efficiently. Depending on your configuration, automated actions can be used to flag risk or send email notifications.

On the AI Governance menu, select AI policies.

The AI policies screen appears.
Click the name of a policy.

The policy details screen appears.
Go to the Enforcement actions tab, then click the Add action button.
Select one of the following actions:
- Flag risk - to create or update a risk record for the policy violation.
- Send email - to send an email notification for the policy violation.

To flag a risk

Select Flag risk, then click the Next button.

The Action details for flag risk pane appears.
To run the action automatically, enable Automate actions.
Trigger on status shows Violation detected as the status that triggers the action. If the action is automated, the selected risk is automatically flagged every day at 11:00 AM UTC when a new violation is detected.
Select a risk from the selection menu. The related risk details appear.
Complete the risk details as needed. For more information about the available risk fields, see Creating and Managing Risks.
Click the Add action button to save the risk action.
Go to the Violations tab.
Click on the Context Menu icon for a given violation, then select Flag risk.
Select from the active risks configured for this policy, then click the Flag risk button.

To send an email

Select Send email, then click the Next button.

The Action details for send email pane appears.
Fill in the following fields:
Field

Description

Automate actions

Enable Automate actions to run the action automatically.

Trigger on status

Shows Violation detected as the status that triggers the action. If the action is automated, the system sends an email at 11:00 AM UTC if a new violation detected. A separate email is sent for each detected violation.

Recipient type
Select one of the following:
- Custom users - to send the email to specific users.
- Policy owner - to send the email to the policy owner.
- User type attribute - to send the email to users based on selected user type attribute values.
Additional context

Enter the comments to include in the email.
Click the Add action button to save the email notification.
Go to the Violations tab.
Click on the Context Menu icon for a given violation, then select Send email notification.
Review the email notification that will be used for the violation, its recipients, then click the Send button.

To configure manual steps

On the AI Governance menu, select AI policies.

The AI policies screen appears.
Click on the name of a policy.

The policy details screen appears.
Go to the Enforcement actions tab.
The OneTrust manual option offers a text editor where you can define the remediation steps to help users resolve policy violations.
Click the Save button to save your manual instructions.
Go to the Violations tab.
Click on the Context Menu icon for a given violation, then select View manual steps.
A side pane with your written manual steps will appear as instruction reference on how to remediate violations.

Additional Context Menu Options

Additional enforcement options are available at the violation level, allowing users to take action on individual violations.

Create task

On the AI Governance menu, select AI policies. The AI policies screen appears.
Click on the name of a policy. The policy details screen appears.
Go to the Violations tab.
Click on the Context Menu icon for a given violation, then select Create task.
A new modal appears for you to configure the task for that violation.
Click the Save button.

Trigger integration

On the AI Governance menu, select AI policies. The AI policies screen appears.
Click on the name of a policy. The policy details screen appears.
Go to the Violations tab.
Click on the Context Menu icon for a given violation, then select Trigger integration.
A new modal appears for you to select active connections to initiate integration workflows to help automate the policy.
Click the Save button.

Suppress violation

On the AI Governance menu, select AI policies. The AI policies screen appears.
Click on the name of a policy. The policy details screen appears.
Go to the Violations tab.
Click on the Context Menu icon for a given violation, then select Suppress violation.
The Suppress violation modal appears. Click the Suppress violation button to pause related alerts and escalation for the violation.
You can resume alerts and escalation for the suppressed violation. Click the Context Menu icon, then select Resume monitoring.
The Resume monitoring confirmation modal appears. Click the Resume monitoring button to resume alerts for the violation.

AI Governance Manager