How to Monitor AI Interactions on Employee Devices

Monitoring has to happen on the device, because three categories of AI use never reach the network in a form anything can inspect. Local models run without leaving the machine. Desktop applications that pin their certificates sit on an inspection bypass list by design. A laptop on a home connection routes through nothing the organization operates at all.

‍

The uncomfortable part is that the first two are deliberate. Somebody approved the bypass, and the approval was correct on its own terms.

‍

Why Are Desktop AI Applications Exempt From Inspection?

‍

Because they pin certificates, and a pinned application refuses the substituted certificate a proxy has to present. The application stops working rather than degrading, so the only remedy is to exclude it from inspection entirely.

‍

The Exclusion Is Vendor Policy

‍

Secure access vendors ship this as a feature. Versa Networks publishes a predefined list of applications excluded from TLS decryption that are implicitly bypassed because of pinning, and Cloudflare documents that its decryption breaks the ChatGPT desktop client along with common developer tooling. The bypass list is standard practice rather than a misconfiguration.

‍

Which Makes the Exemption Structural

‍

A security team asked to inspect AI traffic and a security team asked to keep the desktop client working are being asked for incompatible things at the proxy. Resolving the conflict means moving the inspection point rather than arguing about the list.

‍

What Does the Bypass Produce Downstream?

‍

Traffic that reaches a named AI tool with its content unexamined, recorded as having happened and nothing more.

‍

Why the Finding Still Matters

‍

Knowing that an interaction happened, with which tool and under which identity, is a weaker record than knowing what was in it and a far stronger one than nothing. The useful system raises the bypass itself as a finding rather than reporting silence.

‍

What It Cannot Answer

‍

Whether regulated material was involved, which is the question a reportability assessment turns on. What the network cannot establish about an AI session covers that limit for browser traffic, and a pinned desktop client sits one layer further out of reach.

‍

Does Local Classification Invade More or Less?

‍

Less, which reverses the assumption most privacy conversations start from. The architecture that keeps content on the device has a smaller footprint than the architecture that inspects centrally.

‍

What a Proxy Has to Do

‍

Terminate the encrypted connection, read the plaintext, scan it, then open a second connection onward. Full content crosses infrastructure the organization operates, which is the mechanism inspection depends on.

‍

What a Local Classifier Does Instead

‍

Evaluate the content where it already is and emit a verdict. A category identifier, a severity, the action taken and a timestamp leave the device. Prompt text, message bodies, attachments and keystrokes stay on it.

‍

Which Is the Stronger Answer to a Works Council

‍

An architecture that cannot capture content is a different proposition from a policy of not looking at it. Listing what is never transmitted is checkable in a way that an assurance about intent is not.

‍

Browser or Endpoint?

‍

Different positions covering overlapping populations, and most organizations need both for different reasons.

‍

• Browser extension: Reads composed content before transport encryption, covering web applications and personal accounts.
• Endpoint agent: Observes local processes and desktop applications, covering what never opens a browser tab.
• Identity records: Establish which accounts and grants exist, covering integrations nobody deployed an agent for.

‍

Where the Browser Is Sufficient

‍

Organizations whose AI use is overwhelmingly web-based get most of the coverage from the extension alone, and enforcement at the browser is the lighter deployment by some distance.

‍

Where It Is Not

‍

Engineering populations running coding assistants inside an editor, and anybody using a desktop client for a model provider. Both are invisible to a browser extension and to the proxy at the same time.

‍

What Still Falls Outside?

‍

Devices nobody manages, which is a hard limit rather than a degradation.

‍

Why No Agent Helps There

‍

Device-level monitoring requires something installed, and a personal laptop or phone has nothing on it. Inspection cannot reach those devices either, since a proxy needs the organization's root certificate in a trust store it does not control.

‍

What Reaches Them Instead

‍

Identity and application records. A personal device still authenticates, and a grant issued to an AI application is visible in the directory whatever hardware requested it, which shadow AI detection uses as one of its inputs.

‍

The Position to State

‍

Coverage is the managed estate plus whatever identity records reveal elsewhere. Stating that is more useful than a claim of completeness nobody can support.

‍

What Should Be Recorded?

‍

Six fields, and the list is short enough to publish internally, which is what makes it credible to the people being monitored.

‍

The Fields Themselves

‍

A category identifier for what was detected, a severity, the action taken, a timestamp, the application involved, and the employee profile. Together they answer which account, what category and what action, and they answer nothing else.

‍

The Exclusion List

‍

Prompt text, message content, form submissions, file contents, attachments and keystrokes. Naming what never leaves the device is the part a data protection officer will ask about, and writing the policy that governs it is a separate exercise from building the capability.

‍

Who Sees a Finding

‍

Showing the employee the finding raised against their own session at the moment it is raised turns the mechanism into a guardrail rather than an audit, and the same record serves both purposes.

‍

Where Does Kovrr Sit?

‍

Kovrr's AI Security and Governance Platform reads device-level signals alongside network and identity sources rather than choosing between them, with classification running locally in the browser and findings carrying the sources that produced them.

‍

Why the Combination Matters

‍

A pinned desktop client produces a network record with no content and an endpoint record with context. Read together they describe an interaction that neither source could describe alone, which is what the AI Interaction Data Fabric exists to assemble.

‍

Move the Inspection Point

‍

Three categories of AI use never reach the network in inspectable form, and two of them are deliberate. Desktop applications pin certificates, pinned applications break under proxy inspection, and vendors therefore ship bypass lists that exclude them, with Cloudflare documenting the ChatGPT desktop client among the breakages. Local models never cross the network at all, and off-network devices route through nothing the organization operates. Device-level classification resolves this by evaluating content where it already sits, which also carries a smaller privacy footprint than central inspection, since a verdict leaves the machine while the content stays on it. Unmanaged devices remain outside any agent, reachable only through identity records. Kovrr reads device signals alongside network and identity sources rather than choosing one.

‍

To see which AI interactions your current controls record without content, book a demo mapped to your own estate.