Your Team Already Uses Personal AI. Here Is How Your Firm Takes Back Control

By Loïc Guyon, operator of Pitstop · Updated 2026-10-11 · 7 min read

Shadow AI in professional services firms does not require a blanket ban. Start by listing the real work already passing through personal ChatGPT or Claude accounts. Separate public, internal, client, and candidate information. Give the team shared firm context instead of leaving each person to improvise. Then assign an autonomy level to every agent and place a human stop before any email, proposal, post, or other external output. The goal is simple: preserve useful AI work while making the path from prompt to recipient visible. For every use, decide what data may enter, what the agent may prepare, and who approves the exact text before it leaves the firm.

The operating rule: agents may prepare and ask. A person approves the exact text before anything leaves the firm.

What does shadow AI look like inside a professional services firm?

Shadow AI is already part of the workflow when a consultant drafts a client email in a personal ChatGPT account, a recruiter asks Claude to rewrite a candidate follow-up, or an associate pastes project notes into an unshared assistant. The issue is not simply that an AI tool exists. The issue is that the firm cannot see the full path from source material to external message.

That path crosses the work that gives a firm its value: client relationships, proposals, meeting notes, candidate conversations, content, financial work, and internal knowledge. A useful response therefore starts with work, not software. Ask what the team is doing, which information enters the tool, what comes out, and whether the output stays inside the firm or reaches someone outside it.

Do not begin with an abstract policy. Begin with a concrete inventory. One line per real use is enough:

• the work being prepared;
• the information used as input;
• the AI account or agent involved;
• whether the result stays internal or goes outside;
• the person who must approve the external text.

This turns “people are using AI” into a set of decisions the firm can actually make. It also distinguishes work based on public material from work that touches client or candidate information.

Do not confuse adoption with autonomy. Using AI does not remove the required human decision at the external boundary.

Where does risk enter the path from prompt to recipient?

The useful unit of control is not the tool alone. It is the combination of use, information, destination, and decision. The same assistant can help with an internal outline and a client response, but those uses should not receive the same treatment.

Use a matrix like this during the inventory:

The last column converts the inventory into a rule. “Allowed” and “not allowed” do not capture work that changes from one case to another. A complete decision states what the agent can prepare, where the work may live, and where a person must stop and approve it.

The external boundary includes email, a proposal sent to a client, a candidate message, a published article, and any other text that leaves the firm's working space.

How do you regain control without banning ChatGPT or Claude?

The practical answer follows the five actions in the brief: inventory uses, separate data, share context, assign autonomy, and require the human stop. Keep each action visible enough that a partner can inspect it without reconstructing how the team works. Once these decisions are visible, this AI governance framework for small firms gives a compact structure for owners, approval thresholds, exceptions, and retained evidence.

The takeover checklist

• Inventory actual uses. Record the work, input, AI account, destination, and required approver for each use already happening.
• Separate the data. Mark what is public, internal, client-related, or candidate-related before it enters an AI workflow.
• Share firm context. Give the team and its agents one working context for projects, clients and CRM, network, meetings, content, knowledge, finance, and approvals.
• Assign autonomy per agent. Choose a level from L0 to L4 according to what that agent may do inside the workspace. External outputs still wait for a person.
• Place a human stop at the boundary. The agent asks before anything leaves. A person approves the exact text.
• Check the journal. Use the exportable, hash-chained journal to see what happened and identify any gap between the agreed process and the recorded path.

This is a control model built around the work already in motion. It does not depend on pretending that personal AI use can be erased. It gives the firm a shared place for the work and makes the external decision explicit.

In Pitstop, agents can come from ChatGPT, Claude, or Codex through MCP. Remote OAuth supports their connection to the workspace. The agent can request an action, but it never approves its own request.

Approval belongs to content, not intent. A person gives SHA-256-bound approval to the exact content. Change one character and the approval no longer matches.

What should the human stop look like before an external message?

The stop should present the exact text that would leave, not a summary such as “candidate follow-up approved.” The reviewer needs to approve the message itself. If the draft changes, it returns for approval.

Consider a recruiter preparing a follow-up after a candidate conversation. The agent receives the approved role context and the relevant conversation details. It drafts:

Subject: Next step in our conversation

Hi Maya,

Thank you for speaking with us about the consultant role. We would like to continue the conversation and invite you to the next step. Please reply with the times that work for you, and we will confirm one.

Best, Alex

The agent asks for approval. Alex reads the exact subject and body, then gives SHA-256-bound approval to that exact version. Pitstop records the approved exact text and its SHA-256 fingerprint. The agent may then proceed with its own tool. If the agent reports a fingerprint that does not match the approval, the mismatch is visible in the journal.

That small example exposes the difference between a vague review step and an auditable human stop. The person is not approving an agent, a task category, or a general intention. The person is approving the precise output that may reach another human.

Pitstop provides the shared workspace for this model to professional-services firms of 5–50 people. Teams and agents can work across projects, clients and CRM, network, meetings, content, knowledge, finance, and approvals. Autonomy is assigned per agent from L0 to L4, while external outputs always wait for a person. The journal is hash-chained and exportable, so the firm can inspect the recorded path and see any gap.

This approach also keeps the commercial model aligned with a firm-wide workflow: one price per firm, never per seat, plus a free plugin.

Get Pitstop for your firm

Written by Loïc Guyon (Tileo), operator of Pitstop.