PRODUCT OVERVIEW
D[AI]NGEN gives enterprises an AI-specific control layer across applications, models, and sensitive business data. Employees keep their normal access; each AI application receives only the resources explicitly approved for that AI workflow. Discovery & Classification adds a local scan and administrator-review workflow before policy effect. AI usage and cost governance is in advanced development; live provider integration and end-to-end spending enforcement remain under validation.
THE ACCESS PROBLEM
Enterprise access systems were designed around people, applications, devices, and services. AI introduces a different problem: an employee can legitimately access sensitive information while the AI system they are using may have a completely different trust context.
Without a separate boundary, user access can become AI access by implication.
D[AI]NGEN is designed to separate those decisions without changing the employee’s ordinary Windows permissions.
ENTERPRISE QUESTIONS
AI introduces two enterprise risks: sensitive-data exposure and uncontrolled usage or cost. D[AI]NGEN’s current product focuses on the authorization boundary; usage and spend governance is in advanced development, with implemented measurement, attribution, cost, budget, alert, and spending-limit components and remaining live-integration validation.
CURRENT
Administrator-controlled AI application/model availability is included within supported governed workflows.
CURRENT · VALIDATED CORE
The AI application receives its own approved Workspace and resources; the employee retains normal access.
NEXT 90 DAYS
Planned B2B workflow under administrator review.
NEXT 90 DAYS
Temporary grants and expiry are planned for the B2B productization path.
NEXT 90 DAYS
Group policies and individual exceptions remain planned administrator workflows.
ADVANCED DEVELOPMENT
Implemented components include token measurement from supported provider usage data, per-workstation attribution, calculated costs, budgets, alerts, and spending limits. Live provider integration, organizational attribution, alert delivery, and end-to-end enforcement still require confirmation.
PLATFORM EXPANSION
Fleet orchestration and enterprise-scale administration remain later expansion.
MASTER PRODUCT MODEL
D[AI]NGEN gives each AI application its own access boundary. Employees keep their normal access to enterprise data. AI applications receive only the resources explicitly approved for that AI workflow.
Claude approved does not mean Gemini approved. Gemini approved does not mean ChatGPT approved.
The Windows user keeps their normal access rights. The AI application receives an independent, more restricted access scope rather than inheriting the user’s access context.
An approval for one AI application does not automatically transfer to another.
Finance.xlsx
Each AI application receives its own access scope.
THREE ACTORS
The product model separates who decides, who works, and who applies the resulting boundary.
D[AI]NGEN can discover, recommend, apply policy, block, record, and produce product evidence. It must not automatically open AI access based only on Discovery.
ADMIN
DECISION AUTHORITY
EMPLOYEE
USER RIGHTS PRESERVED
D[AI]NGEN
APPLIES THE BOUNDARY
DEFAULT DENY FOR AI
The AI application can access its authorized Workspace and explicitly approved resources. Everything else in the user’s data scope remains unavailable to that AI application by default.
The employee retains their normal Windows access.
USER DATA SPACE
PRODUCT MODULE
Discovery surfaces AI-relevant files, folders and sensitivity signals locally, then places what needs attention into an admin review flow.
Discovery helps enterprises identify what requires attention and organize it into a review workflow. It is a decision-support layer, not an autonomous authorization engine.
Discovery recommends. The admin decides. Nothing is applied automatically.
LOCAL SCAN
Scan and re-scan AI-relevant files and folders inside the governed environment.
RESULTS BY REVIEW STATE
Results group unchanged, removed, needs-review, and awaiting-decision items.
CATEGORIES & SIGNALS
Discovery recommends. The admin decides. Nothing is applied automatically.
![D[AI]NGEN Discovery & Classification scan results and review states](/product/discovery/discovery-classification.png)
Founder-supplied product screenshot showing the Discovery scan and review workflow. It illustrates the module; it does not establish autonomous authorization or universal classification coverage.
VALIDATED · LIMITED SCOPE
The Discovery & Classification module supports local scan and re-scan workflows, grouped results, categories and sensitivity signals, and administrator review states before policy effect.
Evidence is limited to the visible scan/review workflow. Discovery recommends only; it does not authorize access, create policy autonomously, remediate automatically, or apply enforcement without administrator validation.
VISIBLE WORKFLOW
The module supports running a local scan and refreshing results when the environment changes.
REQUIRED BEFORE POLICY
Classifications and recommendations remain review items until an administrator decides.
FIRST-RUN CONFIGURATION
Discovery & Classification is visible in the product with guided setup and Discovery settings. The broader next-90-day B2B productization path still includes installation, business or sector profile, privacy preferences, administrator validation, and policy activation.
No recommendation expands AI access without approval.
PRODUCT MODULE
Local scan, grouped results, review states, and sensitivity signals are visible in the product module.
NEXT 90 DAYS
Business Profile, privacy setup, broader onboarding, recommendations, and policy activation remain productization work.
CANONICAL PRODUCT FLOW
Discovery proposes useful configuration. Discovery never grants access by itself.
The administrator decides. D[AI]NGEN applies the resulting AI-specific access boundary and produces product evidence for the resulting behavior.
ADMIN-CONTROLLED ACCESS
D[AI]NGEN is designed so employees cannot independently expand an AI application’s access scope.
D[AI]NGEN discovers, recommends, applies, blocks, records, and proves. The administrator remains the authority for access decisions.
PRODUCT MAP
D[AI]NGEN is an enterprise control layer for AI applications, models, and data access. The product surfaces are different, but the principle is the same:
AI access should be treated as a separate security decision from user access.
CURRENT · AVAILABLE NOW
Browser Extension
Same D[AI]NGEN security principle
PREVIEW
Desktop
BROWSER EXTENSION
The first available product surface, provided through private access.
WINDOWS DESKTOP
Extends the same AI-specific access model to endpoint workflows. Future product surfaces are not claimed.
PRODUCT MODULES / PLATFORM VISION
D[AI]NGEN’s platform story is deliberately staged: AI application/model and data-access control plus the Discovery review module are current; B2B productization and administrator workflows come next; usage and cost governance is in advanced development; fleet and broader endpoint governance remain later expansion.
Control what AI can use. Control what AI can access. Control how AI is consumed.
AI usage and cost governance is in advanced development; components are implemented, while live integration and end-to-end enforcement remain under validation.
IN PRACTICE
The same product principle becomes easier to evaluate when it is attached to concrete work: sending a selected file to AI, reviewing supported sensitive text, or giving a desktop AI workflow access to selected local resources.
AI COVERAGE
Validated Browser workflows, Preview environments, and development targets are tracked separately so roadmap coverage is never presented as current protection.
VALIDATED
Browser
ChatGPT · Claude · Gemini · Google AI Mode
PREVIEW
Desktop
Claude Desktop
IN DEVELOPMENT
Roadmap
Cursor · Perplexity · Qwen · Microsoft Copilot · Grok · DeepSeek · Mistral Le Chat
WHY THIS PROBLEM EXISTS NOW
Enterprise access controls were built around known identities, applications, devices, services, and resources.
AI introduces another actor into the workflow.
An employee can be correctly authorized to access sensitive enterprise information while the AI application or agent they are using operates with a different trust context, destination, processing model, or purpose.
The authorization question therefore changes. It is no longer only “Can this user access this data?” It also becomes “Should this AI system receive this data in this context?”
D[AI]NGEN is built around that second question.
A CONCRETE EXAMPLE
Consider an employee who is authorized to open a customer contract, a financial model, or an internal project workspace.
That authorization belongs to the employee. It does not automatically establish that every AI application or agent used by that employee should receive the same information.
D[AI]NGEN exists to create a separate boundary for that decision.
WHO THIS IS FOR
D[AI]NGEN is relevant to organizations asking how employee use of AI should fit into existing security, access, data-governance, and risk-management expectations.
Potential evaluators may include:
CONCEPTUAL SECURITY MODEL
The D[AI]NGEN model places a decision point between enterprise data and AI. Identity, data context, destination, and policy are relevant inputs to that decision.
The public model uses ALLOW, REDACT, and DENY to describe possible security outcomes. It is a conceptual representation of the platform direction, not a claim that every underlying capability is already generally available.
ALLOW
Conceptually permit the interaction.
REDACT
Conceptually remove sensitive content before proceeding.
DENY
Conceptually prevent the interaction.
PRODUCT TRUTH V2
D[AI]NGEN now distinguishes between a broad capability category and a narrower behavior validated in a specific product flow.
A broad capability can remain UNKNOWN while a limited, evidence-backed behavior is described with explicit scope. This keeps public communication more accurate without overstating product maturity.
VALIDATED · LIMITED SCOPE
Within supported governed workflows, administrator-controlled policy can define which AI application or model may be used by an employee or endpoint.
Scoped to supported governed Browser/Desktop workflows. It does not claim control over every AI application, model, provider, or unmanaged environment.
VALIDATED · LIMITED SCOPE
In covered browser upload flows, a selected file can be held for review before the AI site receives it.
Validation covered selected AI Browser workflows in Chrome. This does not establish coverage for every browser, AI destination, upload path, or file type.
VALIDATED · LIMITED SCOPE
Configured sensitive-content findings can produce allow, redact, ask-first, or block outcomes in evaluated text and file flows.
This is limited to configured patterns in evaluated flows. It does not establish a complete enterprise policy engine or universal AI policy enforcement.
VALIDATED · LIMITED SCOPE
The Desktop Preview can make selected local resources available through an authorized Workspace rather than treating the user’s full filesystem access as AI access.
Validated in a Windows alpha environment for selected resources. This does not imply general endpoint isolation, universal filesystem support, or production readiness.
LATER ROADMAP
Broader document and PDF redaction is a later product direction; current validated behavior is limited to supported text findings.
AVAILABLE NOW
The D[AI]NGEN Browser Extension is the current product surface and the first concrete implementation of the D[AI]NGEN boundary.
It provides the current product experience for organizations evaluating controlled AI access in browser-based workflows.
![D[AI]NGEN Browser Extension data access view](/product/browser/browser-extension-data-access.png)
AVAILABLE NOW · PACKAGED RELEASE
D[AI]NGEN Desktop is the Windows endpoint Preview surface. It extends the same AI-specific access model beyond browser-based AI interactions and into endpoint-level workflows.
The D[AI]NGEN Desktop packaged release launched on October 21, 2026 and is available for qualified deployments with guided installation. Its technical maturity remains Preview; self-service distribution and fleet-scale production readiness are not claimed.
CENTRAL ADMINISTRATION FOUNDATION
D[AI]NGEN has validated an initial central-management foundation in which administrative intent can be sent to an enrolled endpoint and applied locally.
The endpoint remains responsible for local filesystem reality and enforcement state. Central administration can receive sanitized runtime metadata and product evidence required for review.
VALIDATED · LIMITED SCOPE
An initial central-management foundation has been validated: administrative intent can be sent to an enrolled endpoint and applied locally.
This is an initial foundation only. It does not establish full multi-device management, group policy at scale, centralized request workflows, or fleet orchestration.
PRODUCTIZATION PATH
The current engineering focus is moving from proving the core access-control model to making deployment, configuration, recovery, and administration reproducible for B2B use.
The current Alpha RC validation has been completed in the evaluated product environment. The packaged Desktop release launched on October 21, 2026. The next productization focus is deployment reproducibility, guided onboarding, hardening, and enterprise pilot readiness.
DECISION VS ENFORCEMENT
A management decision and an enforced endpoint state are not treated as the same thing.
The product model requires the endpoint application of the intended access state before that state is considered effective.
NEXT 90 DAYS · ACCESS REQUESTS
The planned B2B workflow includes employee access requests, administrator review, AI-application selection, allowed resource or Workspace selection, duration selection, policy application, and automatic expiry where temporary.
On expiry, the previous access state is intended to be restored. Employees cannot approve or widen their own AI access.
Group-level policies and individual exceptions remain part of the next-90-day administrator roadmap. Initial endpoint-by-endpoint support is acceptable; fleet-scale orchestration remains platform expansion.
NEXT 90 DAYS
Employees may request additional AI access, but cannot approve it themselves.
NEXT 90 DAYS
Temporary access is intended to expire and restore the previous state after administrator approval.
NEXT 90 DAYS
Finance, HR, Engineering, and Leadership-style group policies are planned under administrator control.
NEXT 90 DAYS
Administrator-managed exceptions are planned alongside group policy work.
PLATFORM DIRECTION
Browser Extension and Desktop are different product surfaces built around the same underlying idea: AI access should be treated as its own security decision.
AVAILABLE NOW
The current D[AI]NGEN product surface.
AVAILABLE NOW · PACKAGED RELEASE
Packaged release launched October 21, 2026. Available for qualified deployments with guided installation. Technical maturity: Preview.
PLATFORM EXPANSION
AI introduces two enterprise risks: sensitive-data exposure and uncontrolled usage or cost. D[AI]NGEN addresses the authorization boundary today, while usage and spend governance has reached advanced development.
Implemented components include token measurement from supported provider usage data, per-workstation attribution logic, calculated costs, budget components, alert components, and spending-limit components.
Real provider integration, live organizational attribution, alert delivery, and end-to-end spending enforcement still require confirmation; estimated costs are not presented as audited provider billing.
IMPLEMENTED COMPONENTS
Token measurement uses supported provider usage data where available; this is not universal browser-chat token monitoring.
IMPLEMENTED COMPONENTS
Per-workstation attribution logic and calculated costs are implemented; live organizational attribution still requires confirmation.
IMPLEMENTED COMPONENTS
Budget, alert, and spending-limit components are implemented; alert delivery and end-to-end enforcement remain under validation.
HOW TO EVALUATE D[AI]NGEN
A focused demonstration should make the boundary visible: start protected, choose the business context, run Discovery, review recommendations, approve Workspace or resources, apply protection, and compare user access with unapproved AI access.
Evidence should show the resulting decision and state. Additional-access workflows can be evaluated as next-90-day B2B direction when they are not part of the current validated product surface.
Browser Extension access is available through private access. The Desktop packaged release is available for qualified deployments with guided installation.
![D[AI]NGEN](/brand/logo-dark.png){kind=logo}