Discover and sanction an application

This tutorial walks you through deciding how to govern an AI application your organization is actually using. You will review Discovered Apps, inspect an application's risk and users, sanction it (or block it) through Lists, and confirm it is governed by a policy.

By the end you will have made a clear allow-or-block decision for one application and verified that the decision is enforced.

Prerequisites

You must have permission to view Discovery.
To sanction or block an application, you must have permission to manage lists.
At least one AI application must have been observed in your environment so it appears in Discovered Apps.

Step 1 — Review discovered apps

In the left navigation, select Discovery.
Select the Discovered Apps tab. The view opens on the Chart view.
Adjust the Time Range filter if needed (the default is the last 7 days).
To focus on the riskiest applications, select the High Data Criticality stat card, or set the Data Criticality filter to High and Very High.

Discovered Apps in the WitnessAI Console

Review the applications in use across your organization in Discovered Apps.

Step 2 — Inspect an application's details and risk

Switch to the Table view using the Table icon, and use the Search Apps box to find the application you want to review.
Select the application's name to open its detail panel.
Review the panel tabs to assess the application:

Tab	What to look for
Overview	A summary of the application, the vendor's headquarters, and the supply-chain dependencies it relies on.
Users	The specific users who accessed the application — useful for gauging how widely it is used.
Security	Compliance certifications, security practices, and authentication details, so you can assess risk against your requirements.

Check the Data Criticality rating and whether the application currently has users.

The App Details panel open on the Overview tab, showing the Data Criticality badge, a recommended-action card, and supply-chain dependencies.

Step 3 — Read the recommended action

At the top of the detail panel, a recommended-action card shows how the application is governed right now. Its title tells you whether your own list entries or the default application policy decide access.

Card title	When it appears
Allowed by user decision	The application is on the Allowed Applications list.
Blocked by user decision	The application is on the Blocked Applications list.
Allowed by default policy	No list entry applies, and applications are allowed by default.
Blocked by default policy	No list entry applies, and applications are blocked by default.

When applications are allowed by default, the card reads "All applications are allowed unless added to the Blocked Apps list. Click Block to restrict this application." The card doesn't change with the Data Criticality rating, so weigh the rating and the application's users yourself before you decide.

Note: The recommended-action card appears only for users with permission to view policies. Its Block and Allow controls appear only for users with permission to update lists.

Step 4 — Sanction or block the application

Choose the path that matches your decision.

Option A — Block the application

To block the application directly:

From the detail panel, select Block on the recommended-action card. The application is added to your Blocked Applications list, and the card then reads Blocked by user decision. To undo the decision, choose Remove from List from the card's menu, which returns the application to the default policy.
Alternatively, in the Table view, select Block in the application's Actions cell, or select several applications and use the Block action in the action bar.

Blocking adds the application to the Blocked Applications list.

Option B — Sanction (allow) the application

To approve the application instead:

In the left navigation, select Lists.
Select Sanctioned Applications in the overview table.
In the two-column picker, find the application in the available column and select its checkbox.
Use the center arrow (Move Selected) to move it to the Selected column.
Select Save. A Saved successfully! confirmation appears.

Sanction an application by moving it into the Selected column on the Sanctioned Applications list.

Step 5 — Confirm it is governed by a policy

The way you confirm governance depends on the decision you made.

If you blocked it: the application is automatically enforced for everyone by the Application Access Policy, which is pinned to the top of the Policies page. Open Policies and confirm the Application Access Policy is present and enabled.

The Policies list with the Application Access Policy pinned at position 1, enforcing the Blocked Applications list.

If you sanctioned it: open or create a policy, go to the Sources & Destinations tab, and in the Destination section choose Lists and select Sanctioned Applications (or choose the application directly under Applications). Save the policy so its guardrails govern traffic to that application. See Create a policy.

Important: Some applications share the same underlying endpoint, so blocking one product can block related products that use the same endpoint. Confirm the scope of your decision before relying on it.

What you'll have at the end

A reviewed application with a clear understanding of its risk and users.
A decision applied through Lists — added to Blocked Applications or Sanctioned Applications.
Confirmation that the decision is enforced: by the Application Access Policy for a blocked app, or by a policy that uses the Sanctioned Applications list as a destination.

Discover and sanction an application