AI that acts within human-defined controls.
Reviewed by ContraForce team · Last reviewed
Responsible AI
ContraForce applies risk-based governance to AI-assisted security operations. This policy describes the product principles used to govern automated investigation and response; it does not replace a customer’s own risk assessment or operating procedures.
Last reviewed: August 12, 2026
Scope
This policy applies to AI capabilities developed or configured by ContraForce for security operations, including incident triage, investigation, recommended or executed response, documentation, ticketing, and detection tuning.
Our program is informed by the voluntary NIST AI Risk Management Framework and its Generative AI Profile. Referencing these resources does not represent certification by NIST.
Governance principles
- Human authority: customers define procedures, approval gates, permissions, and escalation thresholds. Material response actions can be held for human approval.
- Bounded access: agents operate only through configured connectors and the permissions granted to them. Access should follow least-privilege practices.
- Evidence before action: investigations should retain the evidence, reasoning record, tool activity, and approvals needed to review the outcome.
- Tenant isolation: provider workflows must preserve customer boundaries and must not use one customer’s incident data as another customer’s operational context.
- Reversibility and escalation: procedures should identify actions that can be reversed, actions requiring approval, and conditions that stop or escalate a run.
- Measured performance: product claims must define their population, measurement window, exclusions, and source. Customer-specific results are not universal guarantees.
Testing and change control
Material workflow or model changes are evaluated against intended use, failure modes, permissions, evidence quality, and escalation behavior before general release. Production behavior is monitored through operational telemetry and customer feedback appropriate to the deployment model.
Customers remain responsible for approving their Gamebooks, connector permissions, and use of automated response in their environments. ContraForce documents known limitations and updates controls as risks or capabilities change.
Data and third-party models
Data handling follows the deployment architecture and governing agreement. Product documentation should identify relevant data paths, retention behavior, connector permissions, and third-party service boundaries. ContraForce does not represent that every deployment has the same data flow.
See the Privacy Policy, Security page, and Trust Center for related controls and disclosures.
Questions and concerns
Report a product-safety, security, or responsible-AI concern to info@contraforce.com. Include the affected workflow, observed behavior, potential impact, and any steps needed to reproduce it without sending sensitive customer data by ordinary email.