AI tools with critical exposure

Direct harm is possible: identity fraud, biometric data, or autonomous action without oversight.

Treat as blocked by default. Tools in this band combine the capacity to cause harm (identity fraud, autonomous exfiltration, biometric data) with little or no contractual guarantee. If there is a legitimate use, it needs named approval, a documented impact assessment and periodic review, not an informal exception.