Most organisations now have an AI usage policy. Far fewer can say, with evidence, that the policy is being followed. The gap is rarely the document. It is that nobody checked whether the systems underneath it can actually enforce what it says.
Before staff AI goes live - or as an audit of what is already running - these are the twelve questions I would put to any IT or security leader. Every one of them should be answerable with evidence, not intention. Any question you cannot answer cleanly is the gap to close first.
Identity
1. Is every AI tool and agent in the business a registered identity? You cannot govern what you cannot see. Unapproved tools and unregistered agents - shadow AI - sit outside every control you write down. If your inventory of AI identities is a spreadsheet someone updates by hand, assume it is incomplete.
2. Does AI act under its own assigned authority, or under borrowed human credentials? When an AI assistant acts through a person's login, every action looks like that person and inherits everything they can touch. AI operating in the business should use approved connections assigned to its role, not inherit a staff member's credentials.
3. Can every AI action be attributed to a specific identity and a requesting person? If something goes wrong, "the AI did it" is not an answer. Each action should tie back to the person, digital employee or specialist that requested it.
Permissions
4. Is each AI action checked at the moment it happens? A login once a morning is not authorisation for the rest of the day. Authorisation should be evaluated per request, not assumed from an earlier session.
5. Is the check made against both the AI's authority and the requesting user's permissions? A staff member should not be able to get through an AI what they would be refused directly. If someone without finance access asks the AI for this quarter's invoices, the answer should be a refusal - decided by their permissions, not by the model's judgement.
6. Is every identity limited to the systems, records and actions its role needs? Least privilege should apply to AI roles exactly as it does to people. Broad access granted "for convenience" becomes the breach path later.
Data
7. Is your business data isolated in its own environment? Shared infrastructure means your data's neighbours are strangers. A single-tenant environment keeps your business data and operating boundaries separate from every other customer.
8. Do you know which region your data is stored and processed in - and did you choose it? For Australian organisations handling sensitive records, data residency is often a board-level question. The hosting region should be a decision you make, not a default you discover. The same question applies to where AI models process your prompts.
9. Is the data encrypted at rest and in transit, on private networks? Storage and backups should be encrypted at rest, traffic protected in transit, and databases reachable only on private networks with authenticated access - never publicly exposed.
Accountability
10. Is there a complete audit trail, and can you export it? Logs you cannot get out of the platform are decoration. The audit trail should cover what every AI identity did, what it accessed and on whose behalf - and be exportable for your own review and reporting.
11. Are budgets and spending limits set per AI identity? An AI role with no spending limit is an open purchase order. Budgets should be set, enforced and visible per identity, with usage costs transparent.
12. Could you find AI tools the business never approved? This is the question that catches everyone. Identity and access activity should be watched for unapproved AI tools and unregistered agents, so shadow AI is discovered by your systems rather than by incident.
What good answers look like
Notice that none of these answers live in a policy document. They live in architecture: registered identities, per-call verification, isolated environments, exported evidence. The policy still matters - but it should describe what your systems already enforce, rather than serve as the only thing standing between your data and a tool somebody found online.
Where Holiday fits
This checklist is how we think about the problem, because it is the problem we built Holiday to solve. Holiday runs as a single-tenant environment in the AWS region each customer chooses, with five services that map directly onto these questions: AI Governance for permissions, budgets, audit and reporting; Our Environment for the isolated deployment that connects your business systems; AI Security for zero-trust checks on every tool call; Business Chat for permissioned answers across email, CRM, documents and finance; and Shadow Agent Detection for finding the AI tools nobody approved.
The organisations that come out ahead on AI will not be the ones with the longest policy documents. They will be the ones whose policies are executable. Twelve questions is a good place to start.