Shadow AI Test — DET-009 | Allow Exception

Test Spec

IDSAI-DET-009

TypeNegative

Domain policyAllow (not Isolate)

AI signals on pageSparkle + placeholder

Expected Tier 2NONE

Expected Tier 3NONE

Expected logTier 1 proxy only

⚠ Pre-condition — Admin Portal setup required This domain must be configured with an Allow exception in Web Policy before running this test. Shadow AI requires Isolation — Allow bypasses the Surrogate Browser and the extension never runs.

Pre-conditions Checklist

Domain set to Allow in Web Policy exceptions (not Isolate)

Shadow AI global toggle is ON for the tenant

Page is accessed via the isolated browser session as usual

✓ Key assertion Page has AI signals (sparkle + placeholder). Without Isolation, the extension does not run. Only a standard Tier 1 proxy log should appear — no Shadow AI tab in Event Details.

Page Event Log

» page loaded — AI signals present but domain is Allow

test-pages.menlotest.com/automation/shadow_ai/det_009_allow_exception.html

⚠ Allow Policy

Workspace — Allow Policy Domain

This page contains AI signals identical to DET-001. The only difference is the domain policy. Because the domain action is Allow (not Isolate), the Surrogate Browser extension does not execute — no Shadow AI detection occurs.

AI Assistant (signals present but should not be detected)