Sophos Urges Rules at Sensitive Uploads Before AI Judges Intent

A model watching an employee copy a customer list can describe the action. It cannot tell from that action alone whether the employee is finishing legitimate work or taking the list out of the company. That is the access-control problem in Sophos researcher Nash Borges’s analysis of AI that infers user intent from endpoint activity.

On employee laptops, the upload or share button is where policy decides whether customer data may leave. Blocking a legitimate transfer interrupts work; letting a harmful one proceed exposes data. Borges, who leads AI, engineering and threat research at Sophos, proposes combining contextual scoring with explicit policy at sensitive actions. Borges is assessing a control design as endpoint products begin offering real-time decisions.

Screen context meets a timing problem

An endpoint model can watch the browser, clipboard and files and try to stop a risky action before it completes. Borges distinguishes a model that reconstructs a task after the user finishes from one that has to decide while the user is still working. The latter sees only the session so far. It may identify a file transfer correctly and still mistake the person’s motive.

Job fit offers a narrower question. A scoring system can compare access with a person’s role, team, resources and recent work, then send unusual activity to a reviewer. Sophos discusses Google’s Facade research as an example of that approach. An employee reading a job-relevant file can fit the baseline even when the purpose is harmful. Likewise, a scam victim may log in normally and authorize a payment while someone directs them elsewhere. The person at the keyboard is real; the proposed transaction is the risk.

Put the rule at the transfer

Borges writes, “Explicit policy sits at the sensitive action.” For an external AI upload, that means deciding which customer-data transfers are allowed at the destination before asking a model to guess why the employee is sending them. The model can add context such as job fit or recent activity. A permitted but uncertain action can prompt for justification or route the session to a reviewer; a clear policy violation can be blocked at the transfer.

The rule allows approved transfers and blocks prohibited destinations. The score helps prioritize ambiguous cases. Sophos recommends measuring attackers caught within a fixed number of daily reviews and how often normal work gets interrupted. A high ranking score alone says little about the analyst’s workload when nearly every observed action is benign.

NIST offers voluntary AI risk guidance for trustworthy system design, use and evaluation. For this endpoint use case, evaluate the actual access decision and how often it interrupts legitimate work. The model’s intent label can help a reviewer prioritize uncertain transfers; policy decides what is permitted. NIST says the framework is being revised.

Test with the real review queue

Start with a single sensitive workflow, such as customer data moving to an external AI service. Map the upload and share actions, the destinations and the existing policy decisions. Run contextual scoring in observation mode, preserving the action, resource, destination, policy result and model score with enough session context for a reviewer. Set a daily review budget before evaluating the queue, and count legitimate transfers that the proposed intervention would hold or block.

Then test the failure the model is likely to miss: a job-relevant access that looks ordinary. Borges recommends red-team exercises that pad harmful behavior with everyday activity, because a detector trained to prize normality may rank that session as safe. Retain explicit restrictions on sensitive destinations even when the score is low. Promote an inferred-intent intervention only when the measured review workload and interruptions fit the team that will operate it.

Verify the transfer decision

At a customer-data upload to an external AI service, exercise a prohibited destination and confirm the policy blocks the transfer with an action, resource, destination and policy-result record. Exercise a permitted but ambiguous transfer and confirm the reviewer receives the model score and enough session context to decide within the preset daily queue. Count legitimate transfers delayed by that second path; keep the intervention in observation mode if interruptions exceed the team’s budget. Repeat with a job-relevant harmful transfer mixed into ordinary activity. A low anomaly score on that run should never override the destination rule: an employee doing familiar work can still send sensitive data to a forbidden place.