Block Unauthorized AI Tools
Across Your Financial Network

# Generic NGFW — Configure External Dynamic List for AI Tools
# Adapt commands to your platform's CLI or management console

# 1. Create an external domain list object
#    - Type: domain list
#    - Source URL: https://edl.yourcompany.internal/ai_domains.txt
#      (internally hosted file, regenerated daily from the API CSV
#       or the EDL export on your account downloads page)
#    - Refresh interval: hourly

# 2. Create a security / firewall policy rule
#    - Source zone: internal / trust
#    - Destination zone: external / untrust
#    - Destination: reference the external domain list above
#    - Action: deny / block
#    - Logging: enable end-of-session logging to your SIEM

# Splunk SPL — Alert on AI tool access attempts by user

index=firewall sourcetype=firewall:traffic action=denied
  dest_category="ai-tools-blocklist"
| lookup ad_users src_ip OUTPUT user, department, manager
| stats count by user, department, dest, _time
| where count > 5
| eval risk_score = case(
    department="Trading", 95,
    department="Wealth Management", 90,
    department="Compliance", 85,
    department="IT", 60,
    1=1, 70)
| sort - risk_score

# Python — Filter the AI Tools Blocklist by category for selective enforcement

import csv
import requests

# Categories to block in a financial institution
BLOCKED_CATEGORIES = {
    "Text & Language",         # Writing assistants, chatbots
    "Code & Development",       # Code assistants (IP risk)
    "Audio, Voice & Music",     # Voice cloning, transcription
    "Image & Visual",           # Deepfake risk
    "Agents & Automation",      # Autonomous data access
}

# Categories permitted for research analysts
ALLOWED_CATEGORIES = {
    "Data, Analytics & Research",
    "Search, Knowledge & Docs",
}

def generate_filtered_blocklist(csv_path, output_path):
    blocked_domains = []
    with open(csv_path) as f:
        reader = csv.DictReader(f)
        for row in reader:
            if row['primary_category'] in BLOCKED_CATEGORIES:
                blocked_domains.append(row['domain'])

    with open(output_path, 'w') as f:
        f.write('\n'.join(blocked_domains))

    print(f"Generated blocklist: {len(blocked_domains)} domains")

generate_filtered_blocklist(
    "ai_tools_database.csv",
    "financial_services_blocklist.txt"
)

# PowerShell — Generate quarterly AI tool compliance report

$startDate = (Get-Date).AddMonths(-3).ToString("yyyy-MM-dd")
$endDate = (Get-Date).ToString("yyyy-MM-dd")

# Pull blocked AI tool access attempts from SIEM API
$events = Invoke-RestMethod -Uri "https://siem.internal/api/search" `
  -Method POST -Body (@{
    query = "action=denied dest_category=ai-tools"
    earliest = $startDate
    latest = $endDate
  } | ConvertTo-Json)

# Blocklist metadata and domain count from the database API
$BlHeaders = @{ "X-API-Key" = "YOUR_API_KEY" }
$dbInfo = Invoke-RestMethod "https://www.aitoolsblocklist.com/api/database/?action=database_info" `
  -Headers $BlHeaders
$dbCsv  = Invoke-RestMethod "https://www.aitoolsblocklist.com/api/database/?action=download_database" `
  -Headers $BlHeaders

# Summary statistics
$report = @{
    Period                    = "$startDate to $endDate"
    TotalBlockedAttempts      = $events.Count
    UniqueUsersBlocked        = ($events.user | Sort-Object -Unique).Count
    TopBlockedTools           = ($events | Group-Object dest |
                                Sort-Object Count -Descending |
                                Select-Object -First 10 Name, Count)
    BlocklistLastUpdated      = $dbInfo.last_updated_unix
    TotalDomainsInBlocklist   = ($dbCsv | ConvertFrom-Csv).Count
}

$report | ConvertTo-Json -Depth 3 |
  Out-File "Q$((Get-Date).Quarter)_AI_Tool_Compliance_Report.json"