The sign-up page moves faster than the review.
One route for every model call, one policy, and a log you should have had from the start.
New models arrive every few weeks, each with different behaviour, price and risk. Staff sign up to tools you have not reviewed. Choosing a model is an infrastructure decision, and today it is being made one person at a time.
of UK employees say they have used AI tools their employer did not approve (vendor survey, 2,003 people).
Microsoft UK / Censuswide, 2025of enterprise AI tools are said to run without IT oversight (vendor survey).
Zluri, 2025of UK organisations in IBM's study had no AI access controls (vendor research).
IBM Cost of a Data Breach, UK, 2025Six problems that land on the technology team.
of enterprise AI tools are said to run without IT oversight (vendor survey).
Zluri, 2025 (vendor survey)Staff use personal accounts, browser tools and features added to software you own. What it costs you: a security review that covers a fraction of the estate.
Providers retire models at short notice. One major provider gave about two weeks' notice on four models in February 2026. What it costs you: broken workflows, retested prompts and assessments that no longer match.
Rules tied to a vendor's settings break when you change vendor. What it costs you: rework each time, and vendor lock-in by default.
Ramp's April 2026 data show premium models took 56% of AI cost for 46% of tokens (vendor data). What it costs you: the largest controllable line decided by habit.
Netskope's 2026 data show 47% of generative AI users on personal accounts (vendor telemetry). What it costs you: data protection exposure you cannot measure.
The National Cyber Security Centre advises dedicated identities, scoped credentials, logging and a way to stop agents. What it costs you: a security model to build and keep current.
The right model for each task, set once by policy.
Routine work goes to a suitable approved model. Premium models are used when the task needs them. Providers can change without retraining people.
Diagram of tasks plotted by complexity against model tier. Matched tasks sit on a diagonal. A group of routine tasks sits at the premium end, where a smaller model would do.
Do not approve tools one by one. Build the route every request travels.
Approving tools individually never catches up, because tools multiply faster than reviews. A route does. If every connected request passes through one point that checks who is asking, applies the rules, protects the data, chooses an approved model and records the result, then a change of provider becomes a test and a change record, not a rewrite. The route only governs what is connected to it, so the work is to connect the right things and be honest about the rest.
GenWA view. Guard applies to connected, routed integrations only.
Six ways to turn the route into something you run.
Rules, Model Choice, Change Control, Sandbox, Register and Data Protection are in early access. Plain-English rule writing and tested model switches are being built. We confirm in writing what is live for you.
GenWA applies your rules and data protection to AI use, and keeps the record. Deployed in your AWS or Azure account, or hosted by GenWA on AWS as agreed.
About GuardRouting by taskModel Choice sends each request to an approved provider suited to the task: OpenAI, Anthropic, Amazon Bedrock, Azure OpenAI, Google Gemini or a private model.
About Model ChoicePersonal data held backData Protection redacts or holds back personal data before a request leaves, and records what it held.
About Data ProtectionRules by task and data typeRules states which model may do which work and where AI must not be used, enforced by Guard.
About RulesModel changes, trackedChange Control keeps a catalogue of the models in use, tests releases in the Sandbox for capability, cost and data handling, and briefs you monthly.
About Change ControlA list of what is in useRegister finds tools, accounts and agents and the data they touch, and keeps the list current, so you can see what is outside the route.
About RegisterThree moves for the technology lead.
Three routes, matched to how technology teams buy.
An independent audit of use, cost and control, a review of instruction files and prompts, and build-or-buy facts using your own numbers.
See advisoryProductRules, Model Choice and Register, hosted in your AWS or Azure account, or by GenWA on AWS as agreed. Rules, prompts and records are yours.
See GuardIncubatorIf your team wants agents without staffing a new function, we define, build and run them behind the same control layer, and you can take them back.
See the IncubatorThe three colleagues who share the route.
Reviews hosting, identities and data handling, and agrees what is blocked.
Checks that personal data is held back and that impact assessments match reality.
Owns the cost view that routing and metering feed.
For the CFOEngineers pasted source code into a public chatbot, and the company banned it.
In 2023 Samsung engineers were reported to have pasted semiconductor source code and meeting notes into ChatGPT within about 20 days of the company allowing it. Samsung then banned the tool. A ban removed the use and also the visibility. An approved route with redaction would have kept the productivity and applied the rule at the point of use.
Reported by CNBC and Forbes, 2023. Public incident. GenWA had no involvement.
Want to see the route working?
Book a demo with your technical lead, or share your usage data for a first analysis.
Each task should carry only the context it needs.
Three stacked layers: company context shared by everyone, role context shared by a team, and task context used once and then dropped.
- Company contextShared by everyone
Who you are, how you write, the rules that apply to all work. Kept once and kept current.
- Role contextShared by a team
What finance, legal or sales needs to know to do its job well. Added for that role only.
- Task contextUsed once, then dropped
The documents and facts for this one job. Loaded when needed, so tokens are not spent carrying the rest.
Keep reading
Analyse
Model maxing: why your AI bill grows faster than its value
Using the biggest AI model for every task feels safe. Why it happens, what it costs and where to start.
By Steven Myers · 5 min read
Guard
Harnesses: the controls that make AI safe to put to work
What a harness is, what it does, what happens without one, and why deploying it well is a skill of its own.
By Lukasz Piotrowski · 5 min read
Straight answers.
How do I give teams model choice while keeping control and a log?
Set one policy and one route. GenWA applies your rules to connected tools and models, with redaction, metering and a log. Rules decide which model does which work. Providers can change without retraining people, because the policy attaches to GenWA, not to a vendor.
Should we build our own control layer?
Some teams do. Ask what it costs to keep current with model changes, redaction, metering and evidence. The audit gives you the build-or-buy facts using your own numbers, so the decision is yours.
Does GenWA find every AI tool in the business?
No. Controls apply to connected, routed integrations. Register helps surface other tools, accounts and agents, but we do not claim to discover or block every unmanaged app. Giving people an approved route is usually more effective than a ban.
What happens when a model is retired or a better one launches?
Change Control keeps a catalogue of the models in use and briefs you when one changes. Testing in the Sandbox before release is in early access. Tested switches with rollback are being built next, not live. Your rules do not change when the provider does.
Where does our data sit, and can we leave?
Hosting is in your AWS or Azure account, or hosted by GenWA on AWS as agreed. Personal data is redacted before approved external model calls. Rules, prompts and records are yours. Contractual exit and data-return terms are confirmed in writing.
Which model providers do you support?
OpenAI, Anthropic, Amazon Bedrock, Azure OpenAI, Google Gemini and private models. Routing sends each request to an approved provider suited to the task, under your rules.
How do we start a technical and security evaluation?
Book a demo with your technical lead, then request the security review. It covers hosting, approved model providers, redaction before external calls and data handling. You can also share your usage data first for an analysis of model fit and cost.
Set one policy and one route.
We confirm in writing what is live before you commit. Controls apply to connected, routed integrations.