Every vendor selling you a "shadow AI" fix is selling you a security story. Data leakage. Prompt injection. Customer PII walking out the door in a ChatGPT prompt.
That story is true. It's also incomplete — and the part it leaves out is the part your CFO actually feels.
Shadow AI isn't just data leaving the building. It's money leaving the building. Quietly, every month, with no owner and no budget line.
The frame everyone uses
Ask a security vendor what shadow AI costs you and they'll talk about risk: an employee pastes a contract into an unapproved model, a personal ChatGPT account trained on your roadmap, a prompt-injection attack through a browser extension nobody vetted.
Real problems. Worth solving. But notice what that frame never asks: how much are we spending?
Because the answer is uncomfortable, and it doesn't show up in any security dashboard.
The frame nobody uses
Here's what's actually happening while security counts leaks:
Duplicate seats nobody tracks. Three teams bought Cursor separately. Two departments expense Claude Pro. Someone in marketing has a Perplexity subscription, and someone else has the same one under a different card. Nobody reconciles them because nobody owns the AI line.
Personal API keys on the expense report. An engineer put their own OpenAI key on a side project, it worked, and now it's load-bearing — reimbursed monthly as a $40 "software" line that's really ungoverned production spend with a personal card behind it.
Unused licenses. You bought 200 Copilot seats. Forty people use it weekly. The other 160 are pure waste, and the renewal auto-approves because nobody's looking at utilization.
Spend that never hits a budget. Add it up and it's real money — and none of it was forecast, capped, or attributed to anyone. It's just… gone, spread across a dozen invoices in a dozen systems.
That's not a security problem. That's a budget problem wearing a security costume.
Security frame vs budget frame
| | The security frame sees | The budget frame sees (and it misses) | |---|---|---| | Personal AI accounts | Data leaving to an unapproved model | Duplicate spend, reimbursed on personal cards, with no owner | | Unapproved tools | Attack surface, prompt injection | Seats bought three times across three teams | | Purchased licenses | Access to govern | Utilization nobody tracks — you're paying for idle seats | | A departing employee | Credentials to revoke | Spend that keeps running after they're gone | | The AI line item | Not its job | A cost center with no budget, no cap, no forecast |
Both columns are real. The security vendors only sell you the left one. The right one is bigger, quieter, and lands on the person who signs the invoices.
The part HR and finance already know how to solve
Here's the reframe that makes this fixable: you already govern every other kind of access this way. AI is the one exception.
When someone joins, you don't let them find their own laptop. IT provisions it. You don't let them mint their own badge — facilities issues one. SaaS seats go through a request, an approval, and a budget. There's a joiner-mover-leaver process, and it works because access is provisioned, not improvised.
Then AI showed up and everyone forgot the playbook. AI access is a free-for-all. No provisioning, no owner, no de-provisioning. People sign up with a work email and a personal card and nobody ever files the paperwork.
The fix isn't a new security product. It's applying the process you already run for badges and laptops to the one kind of access you left ungoverned.
An AI key per employee, provisioned like any other seat
That's exactly what a Virtual AI Key is. Instead of everyone bringing their own account, each person gets one governed key — issued the way you'd issue any other seat:
- Provisioned like a badge. A key per employee, budgeted by role. An engineer's budget isn't a support rep's budget isn't an exec's budget. The cap is set on the way in, before the spend — not discovered on the invoice after.
- Attributed by default. The Token Ledger records who spent what, on which project, for which purpose — the five-dimension answer (WHO / HOW MUCH / WHY / WHERE / WHEN) behind every key. No more "who is this $4,000 from?" No more personal cards standing in for company spend.
- Tied to your HRIS. Tokenality ingests your directory — BambooHR, Workday, and Rippling connectors are live today — so AI access maps to your actual org chart. Every key has a person, a team, and a manager behind it.
- Hard-capped, not hopefully-capped. The budget is enforced on the key at the gateway, and a second factor binds the key so a leaked one is a dead one. Budgets aren't a spreadsheet you reconcile later; they're a limit the key can't exceed.
One honest caveat, because the whole point here is honesty: HRIS ingest is live today; automatic revoke-on-exit is on our roadmap. So right now you get the full joiner-and-mover picture — every employee's AI access visible, budgeted, and attributed against your directory. Automatic de-provisioning the moment someone's marked a leaver is coming, not shipped. We'd rather tell you that than let you find out later.
Why this is a finance and people conversation, not just a security one
Because the people who can actually fix shadow AI aren't in the SOC.
The CFO can turn AI from an untracked pile of invoices into a forecastable line — capped, attributed, defensible in a budget review. The People director can fold AI access into the joiner-mover-leaver process that already governs every other seat, so it's provisioned on hire and visible from day one.
Security still matters — fail-closed PII and signed identity ride on the same keys. But framing shadow AI as only a security problem hands it to the one team that can't put it on a budget. Frame it as a spend problem and it lands where the money actually is.
Shadow AI is money leaving the building. You already know how to stop that — you do it for laptops, badges, and every SaaS seat you own. Do it for AI.
See what per-employee AI governance looks like on the for-people page, or issue a governed key and watch it enforce a budget live in the playground.