Acceptance criteria
Monitor AI destinations and agent activity only, not general browsing. Minimize captured content and allow full capture to be switched off, ring-fence named individuals such as executives, exclude personal conversations from analytics, and document the configuration for privacy, legal and workforce review.
Why it matters
Works councils and privacy teams judge the architecture, not the policy document.
How to verify
Show that non-AI browsing is not captured, a ring-fenced user is excluded, and the configuration is documented.
OWASP adoption context
Monitoring reaches employees in every listed context, so scope limits should be enforced on each surface, not only in the browser.
Framework mappings
Limiting collection to AI activity, minimizing content and ring-fencing sensitive individuals protects personal information within the monitoring itself. A documented configuration supports review; it does not settle whether the monitoring is lawful. SOC 2: P3.1, P4.1 require the Privacy category and relevant information in scope.
Privacy-limited monitoring is a concrete treatment for the privacy risk the control itself creates for employees. It does not replace an impact assessment of the monitoring.