AI Governance
What Is Warn and Justify (AI Coaching)?
- Hold the prompt
- Reason on record
- Mask or send
Short answer
Warn and justify is an AI usage control that pauses a prompt containing sensitive data instead of blocking it. The person sees what kinds of data were found and chooses to mask and send, send anyway with a written reason, or cancel. The reason is recorded for the security team.
Maskflare Engineering Updated
Why is there a middle option between allow and block?
A contracts manager pastes a draft supplier agreement into an AI assistant to simplify the wording. The text contains commercial terms and two signatory names. Blocking stops legitimate work. Allowing silently means nobody ever learns it happened. Both are the wrong answer for data that people sometimes do have a good reason to share.
Warn and justify is built for that gray zone. Most sensitive data in AI tools isn't leaked on purpose. Someone is rushed, pastes the whole thread and misses the account number at the bottom. A short, clear message at the moment of the paste is more likely to change behavior than a training session from last spring.
What does the person see and choose?
In Maskflare, a rule set to the warn action holds the message until the person answers. A dialog opens on the device with the title "Confirm before sending to" and the app name. It shows a short message, the kinds of data found, and a link to your AI policy. It does not show the values themselves, so the warning never repeats the sensitive data.
| Choice | What happens | What is recorded |
|---|---|---|
| Mask and send | Sensitive values are replaced with tokens and the prompt goes out | That the person chose to mask |
| Send anyway | A reason step opens; the prompt goes out as written after the reason is given | The reason, the app and the categories |
| Cancel | Nothing is sent; the person can edit the prompt | That it was cancelled |
After an answer, the dialog tells the person to send the message again, and that next attempt is let through once, as written or masked. The reason is a short free-text field, and your IT team can read it. That is stated in the dialog, so nobody is surprised.
Is a justification the same as an approval?
No. A justification is a recorded decision by the person for one prompt. It doesn't change the rule. If the same legitimate case keeps appearing, say the legal team regularly sharing contract terms with an approved assistant, that is a signal to change the rule through your normal review, for example with four-eyes approval in the console. The justifications are the evidence for that decision.
When should you warn, mask, block or only monitor?
| Data | Suggested response | Why |
|---|---|---|
| Routine identifiers the AI doesn't need (emails, phone numbers) | Mask | The answer is still useful and nobody is interrupted |
| Contract terms, health details, HR matters | Warn | Sometimes legitimate, always worth a second look |
| API keys, passwords, card numbers | Block | Almost never a good reason, and the harm is immediate |
| Anything new you don't understand yet | Monitor | Count first, enforce later |
The response is set per rule, so you can mix them. Warning on everything trains people to click through. Keep warnings for categories where a human decision adds something.
How does this relate to AI literacy and policy?
Article 4 of the EU AI Act asks providers and deployers to take measures to support AI literacy of their staff. It has applied since 2 February 2025, and the Digital Omnibus (Regulation (EU) 2026/1744) rewrote it so that it no longer requires a guaranteed literacy level for each individual. See the EU AI Act page and the text on EUR-Lex. A warning dialog is not training and doesn't satisfy Article 4 on its own, but it is a practical, repeated reminder that supports a literacy program, and the records show what people were told. This is not legal advice.
It also puts your written rules in front of people at the right moment. If you have an AI acceptable-use policy, the dialog is where its link does the most good.
How does Maskflare do it, and what are the limits?
User coaching works through the desktop agent on managed devices, so the dialog appears on laptops that have the agent. API callers get the same decision as a response their code handles. Detection uses the same engine as masking: deterministic patterns, checksums and context, plus a local named-entity layer for names, places and free-text details; every match is explained. Events can be sent to Splunk, Microsoft Sentinel, Slack, Microsoft Teams, PagerDuty and any HTTPS endpoint, and the console shows justifications and a "this is wrong" feedback signal that turns false positives into suggested allowlist entries for review.
- It needs the desktop agent on a managed device. Personal phones and unmanaged laptops are not covered.
- A person can still choose to send anyway. That is the design: the control trades a hard stop for an explanation and a record. Use block where a stop is required.
- The dialog names categories, not values, so it can't tell the person which exact item triggered the rule.
- It is one tool in your wider AI usage control. It doesn't classify your AI systems or manage risk registers.
Frequently asked questions
What is the difference between warn and block?
Block stops the prompt. Warn holds it, tells the person what kinds of data were found, and lets them mask and send, send anyway with a reason, or cancel.
Does the warning show the sensitive value?
No. It names the category, such as IBAN or health data, so the message itself never repeats the sensitive data.
Who can read the reasons people give?
Your IT and security team can. The dialog tells the person this before they write a reason.
Can people just click Send anyway every time?
Yes, if the rule offers it, and each use is recorded with a reason. If the pattern shows legitimate repeated use, change the rule; if it shows misuse, you have the evidence for a conversation.
Does warn and justify work on personal devices?
No. The dialog is shown by the Maskflare desktop agent, which IT installs on managed devices.