How to govern Security in OpenAI
A step-by-step guide to governing Security in OpenAI with Rencore: detect, review by owner and severity, and remediate with an audit trail.
Governing Security in OpenAI means finding where it goes wrong, reviewing the findings by owner and severity, and remediating with an audit trail. Rencore covers this concern for OpenAI with the pre-built controls below, so it becomes a repeatable check rather than a one-off cleanup. The steps that follow apply the same detect, review, remediate loop to Security.
Steps
-
Inventory OpenAI
Connect OpenAI and let Rencore build a continuous inventory of its resources, owners, and configuration, so governance starts from what exists rather than a stale export.
-
Detect with policies
Turn on the pre-built policies that cover Security in OpenAI to surface oversharing, sprawl, and misconfiguration on the first scan, before writing a single custom rule.
-
Review by owner and severity
Use the OpenAI reports to review findings by owner, category, and severity, and to share them with stakeholders who do not have a seat in the platform.
-
Remediate and automate
Apply automations to fix findings at scale, route sensitive changes through approvals, and keep every action reversible and logged for the audit trail.
OpenAI controls for Security
Grounded in the Rencore catalog. See the full OpenAI catalog on the OpenAI connector page.
-
External (guest) user
External guest accounts are a common attack vector, raising the likelihood of risky access
Severity: High -
Project API key is live (recently used)
Recently used project API keys are live credentials, raising the likelihood that a weakness leads to an incident
Severity: Medium -
Admin API key is live (recently used)
Recently used admin API keys are live, organization-wide credentials, raising the likelihood of serious impact
Severity: High -
File never expires
Files with no expiry persist and stay reachable, raising the likelihood that sensitive content is exposed over time
Severity: Medium -
ChatKit thread is active
Active threads are live, ongoing conversations, raising the likelihood that a content or data issue occurs
Severity: Medium -
OpenAI Organizations with too less owners
Detects organizations that has less than 2 owners
Severity: High -
OpenAI Organizations with too many owners
Detects organizations that has more than 5 owners
Severity: High -
OpenAI Project with too less owners
Detects projects with less than 2 owners
Severity: Medium -
OpenAI Project with too many owners
Detects projects with more than 10 owners
Severity: High -
OpenAI agent conversation with malicious request
Detects a chat which might be used to extract sensitive information
Severity: High -
OpenAI File contains PII
Detects uploaded files which contain Personally Identifiable Information for training
Severity: High -
OpenAI File contains sensitive information
Detects uploaded files which contain company, medical or financial data
Severity: High -
OpenAI User is deactivated in Entra ID
Detects OpenAI users that have been disabled in the tenant
Severity: Medium -
External Entra ID users have access to OpenAI
Detects OpenAI user which are external users in the Entra ID tenant
Severity: Medium -
OpenAI Certificate expires soon
Detects organization certificates which will expire soon and should be updated
Severity: High -
OpenAI Certificate is expired
Detects organization certificates which are expired and should be updated
Severity: High -
Unused OpenAI admin API Key should be removed
Detects OpenAI admin API Keys that have not been used within the last 90 days
Severity: High -
Stale pending OpenAI invites should be revoked
Detects OpenAI invitations that have been pending for more than 30 days
Severity: Medium -
OpenAI fine-tuning file contains PII
Detects files used for fine-tuning that contain Personally Identifiable Information
Severity: Critical -
OpenAI Project Certificate expires soon
Detects project certificates which will expire within 90 days and should be updated
Severity: High
