Case study · Northwestern MSIS capstone · 2026
PrivAI Guard
A cloud-deployed full-stack Shadow AI governance MVP that converts potentially risky AI use into structured risk assessment, governance review, remediation, and audit evidence.
Northwestern University MSIS capstone MVP. Non-production. Synthetic demonstration data only. Human governance review — not automated legal or regulatory decisioning.
Role: Designed and developed
Problem
Shadow AI creates operational governance gaps when organizations cannot consistently determine which AI tool is being used, what information may enter it, who is affected, who owns the decision, what remediation is required, and what evidence remains. Informal AI use often arrives as one-off prompts rather than a governed request.
Solution
PrivAI Guard converts an informal AI-use event into a structured governance workflow with human decision points. A reported use can be classified, scored, reviewed for data-subject impact, recommended toward an approved internal AI path, assigned for remediation, and preserved as evidence. Reviewers — not the application — remain accountable for governance outcomes.
Workflow
The implemented model is Check → Assess → Redirect → Act → Prove → See. Check identifies sensitive-data indicators. Assess evaluates risk and potential data-subject impact. Redirect recommends an approved internal AI path where appropriate. Act creates accountable remediation. Prove preserves governance evidence. See provides management visibility. Routing is advisory and human-reviewed; the MVP does not automatically transmit prompt content to another AI service.
Visual workflow evidence
Screenshots from the working capstone MVP, in workflow order: employee control, governance review, remediation, audit evidence, and management visibility.
Employee Safe Prompt Check — evaluates proposed AI use before information is submitted to an AI tool. 
Governance review — brings risk, tool context, data-subject impact, and human decision points into one governed record. 
Accountable remediation — converts identified risk into assigned work, priority, status, and follow-through. 
Governance evidence — preserves review and workflow activity as an auditable record. 
Management visibility — summarizes AI-use checks, risk events, remediation, and governance activity.
Implemented capabilities
Current MVP capabilities include Employee Safe Prompt Check, an AI tool registry, deterministic sensitive-data detection and risk scoring, governance review, data-subject impact review, advisory internal-AI routing, remediation ownership and status tracking, governance audit evidence, dashboard-level management visibility, limited read-only BC/DR checkpoint visibility, and role-aware admin governance.
Technical foundation
The frozen MVP uses a compact stack so architecture supports the workflow rather than becoming the story: Next.js, React, and TypeScript for role-aware interfaces; Supabase Auth and PostgreSQL with Row Level Security and controlled database functions for persistence and authorization; Vercel for non-production Preview hosting; and GitHub for source control and repository quality gates. GitHub Actions validates the repository; this case study does not claim that GitHub Actions deploys to Vercel.
What this project demonstrates
The work connects cybersecurity governance, privacy by design, AI governance, GRC and control implementation, IT and technology risk, role-aware authorization, system-of-record architecture, remediation workflows, and auditability to a working application. It is evidence of applied implementation — not a claim of enterprise-grade or production-ready platform status.
MVP boundary
Implemented Capstone MVP: Northwestern University MSIS capstone. Working non-production MVP. Synthetic demonstration data only. Human governance review. Advisory internal-AI routing. Not enterprise production software, not a commercial multi-tenant SaaS product, and not Northwestern-owned or Northwestern-endorsed commercial software. Potential future product direction — not implemented: enterprise SSO, richer workflow and security integrations, commercial multi-tenancy, production operations, and cost-aware model routing. These remain future direction, not current capabilities.
Stack
- Next.js
- React
- TypeScript
- Supabase/PostgreSQL
- Vercel
- GitHub
Discuss this work
Email and LinkedIn are the public contact channels.