AI Policy Enforcement Guide

Overview

The Enforcement feature in AI Policies brings automated, cross-platform control to how Responsible AI (RAI) policies are applied in customer environments. By extending OneTrust’s existing guardrail enforcement capabilities into AWS Bedrock, Azure AI Foundry, and Databricks, customers can now take direct action on AI agents that violate defined policies without relying on manual intervention or platform-specific workarounds. Instead of policies living in disconnected formats, organizations can centrally define governance rules in OneTrust and automatically enforce them across AWS Bedrock, Azure Foundry, and Databricks. This creates a consistent, customer-facing experience where AI risk mitigation is not just observable but actionable in real time.

For more information about managing AI policies, see AI Policies Feature Guide.

To configure the guardrail enforcement

On the AI Governance menu, select AI policies.

The AI policies screen appears.
Click on the name of a policy.

The policy details screen appears.
Go to the Enforcement actions tab.
As new automations are established, cards for enforcement strategies will be displayed. The card titles will reflect the discovered sources.
Click on a tile to open the active guardrails pane.
Click the Add guardrail button to add a new guardrail for the specific system.

Once you choose a project from the selection field, you can then select one of its guardrails.

For Azure Foundry, requires selection of a hub and guardrail from your account
For Amazon Bedrock, requires selection of a region, guardrail, and the version.

For Databricks, apply the settings required for compliance.

Note:

In Databricks, Guadrail settings are directly associated with models or agents.


Guardrail	Description
Input - Safety	Detect and block unsafe or harmful content, such as reference to violent crime, self harm or hate speech.
Input - PII Detection	Detect and block or mask personally identifiable information (PII) Block Mask
Output - Safety	Detect and block or mask personally identifiable information (PII)
Output - PII Detection	Detect and block or mask personally identifiable information (PII) Block Mask

Click the Save button to retain your guardrails.
Go to the Violations tab.
Click on the Context Menu icon for a given violation and then select Apply guardrail.
A side pane will appear for you to choose the guardrail and applicable details according to the system (Foundry vs Bedrock) where the violation originates.
Make your selections, then click the Save and apply button.
Go to the Enforcement actions tab.
Click on the given system tile to review the active guardrail(s) you configured.

To configure automated actions

AI policy automated actions help reduce manual monitoring and respond to policy violations more efficiently. Depending on your configuration, you can use automated actions to flag risk, send email notifications, or send an assessment.

On the AI Governance menu, select AI policies.

The AI policies screen appears.
Click the name of a policy.

The policy details screen appears.
Go to the Enforcement actions tab, then click the Add action button.
Select one of the following actions:
- Flag risk - to create or update a risk record for the policy violation.
- Send email - to send an email notification for the policy violation.
- Send assessment - to send an assessment for the policy violation.

To flag a risk

Important:

The Flag a risk automated action is under Public Preview. Please contact OneTrust Support to request early access.

Select Flag risk, then click the Next button.

The Action details for flag risk pane appears.
To run the action automatically, enable Automate actions.
Trigger on status shows Violation detected as the status that triggers the action. If the action is automated, the selected risk is automatically flagged every day at 11:00 AM UTC when a new violation is detected.
Select a risk from the selection menu. The related risk details appear.
Complete the risk details as needed. For more information about the available risk fields, see Creating and Managing Risks.
Click the Add action button to save the risk action.
Go to the Violations tab.
Click on the Context Menu icon for the violation you want to flag, then select Flag risk.
Select from the active risks configured for this policy, then click the Flag risk button.

To send an email

Select Send email, then click the Next button.

The Action details for send email pane appears.
Fill in the following fields:
Field

Description

Automate actions

Enable Automate actions to run the action automatically.

Trigger on status

Shows Violation detected as the status that triggers the action. If the action is automated, the system sends an email at 11:00 AM UTC if a new violation detected. A separate email is sent for each detected violation.

Recipient type
Select one of the following:
- Custom users - to send the email to specific users.
- Policy owner - to send the email to the policy owner.
- User type attribute - to send the email to users based on selected user type attribute values.
Additional context

Enter the comments to include in the email.
Click the Add action button to save the email notification.
Go to the Violations tab.
Click on the Context Menu icon for the violation for which you want to send an email notification, then select Send email notification.
Review the email notification that will be used for the violation, its recipients, then click the Send button.

To send an assessment

Select Send assessment, then click the Next button.

The Action details for Send assessment pane appears.
Fill in the following fields:
Field

Description

Automate actions

Enable Automate actions to run the action automatically.

Trigger on status

Trigger on status shows Violation detected as the status that triggers the action. If this action is automated, the policy is evaluated every day at 11:00 AM UTC. When that evaluation detects a new violation, the selected assessment template is automatically sent for the violation.

Copy previous assessment

Enable this option to allow users to copy data from the most recent completed assessment. It includes controls for copying responses, comments, attachments, notes, linked risks, the latest template and inventory values, confirmation of changes, sending a blank assessment, and archiving the original assessment.

Template name

Select the assessment template to send.

Deadline

Enter the number of days after the assessment launch by which the respondent must complete the assessment.

Reminder

Enter the number of days before the deadline when the respondent should receive a reminder.

Select respondents
Select one of the following:
- System users - to assign the assessment to selected users.
- User type attributes - to assign the assessment to users based on selected user type attribute values.
Click the plus icon to add another respondent entry.
Send to Previous Respondent(s)

Assign the assessment to the respondents from the previous assessment.

Select workflow approvers

Select the workflow approver for the assessment. Click the plus icon to add another approver entry.

Use Previous Approver(s)

Assign the assessment to the approvers from the previous assessment.

Advanced options
Enter the additional context:
- Description - a brief description of the assessment.
- Comments to respondent - comments to provide to the respondent with the assessment.
Click the Add action button to save the assessment.
Go to the Violations tab.
Click on the Context Menu icon for the violation for which you want to send an assessment, then select Send assessment.
Select the required template from the active assessment templates list, then click Launch assessment.

To configure remediation steps

On the AI Governance menu, select AI policies.

The AI policies screen appears.
Click on the name of a policy.

The policy details screen appears.
Go to the Enforcement actions tab.
The OneTrust manual option offers a text editor where you can define the remediation steps to help users resolve policy violations.
Click the Save button to save your remediation instructions.
Go to the Violations tab.
Click on the Context Menu icon for a given violation, then select View remediation steps.
A side pane with your written remediation steps will appear as an instructional reference for remediating violations.

Additional Context Menu Options

Additional enforcement options are available at the violation level, allowing users to take action on individual violations.

Create task

On the AI Governance menu, select AI policies. The AI policies screen appears.
Click on the name of a policy. The policy details screen appears.
Go to the Violations tab.
Click on the Context Menu icon for a given violation, then select Create task.
A new modal appears to let you configure the task for that violation.
Click the Save button.

Trigger integration

On the AI Governance menu, select AI policies. The AI policies screen appears.
Click on the name of a policy. The policy details screen appears.
Go to the Violations tab.
Click on the Context Menu icon for a given violation, then select Trigger integration.
A new modal appears to let you select active connections to initiate integration workflows that help automate the policy.
Click the Save button.

Suppress violation

On the AI Governance menu, select AI policies. The AI policies screen appears.
Click on the name of a policy. The policy details screen appears.
Go to the Violations tab.
Click on the Context Menu icon for a given violation, then select Suppress violation.
The Suppress violation modal appears. Click the Suppress violation button to pause related alerts and escalation for the violation.
You can resume alerts and escalation for the suppressed violation. Click the Context Menu icon, then select Resume monitoring.
The Resume monitoring confirmation modal appears. Click the Resume monitoring button to resume alerts for the violation.