News analysis · Published
Valon's AI Access Policy: Why Employees Should Earn AI Privileges
By the ELYMENT AI editorial team · Free to read
Valon has restricted AI tools for most new non-engineering hires until their managers believe they understand the work well enough to identify AI errors. Business Insider reported the policy on 29 August 2026, after chief executive Andrew Wang disclosed it publicly on 18 August. The lesson is not that businesses should ban AI. It is that access, judgement and accountability are separate controls. Leaders should grant AI privileges in stages, require evidence of domain competence and measure whether each use case improves accepted work rather than merely increasing token consumption.
What Valon changed
Valon, a US mortgage-servicing technology company, had broadly deployed AI before changing its onboarding policy. Wang said most new hires must initially learn their role without AI. Engineers are exempt because their output passes through peer review. Other employees regain access when their manager is confident they can recognise an incorrect answer and understand the underlying work.
The company is also treating cost as an operating signal. Wang told Business Insider that Valon's annualised AI token spending had been heading towards roughly US$15 million to US$20 million and projected the restriction could reduce it to about US$4 million to US$5 million. Those figures are Valon's internal projection, not an independently audited saving, but the direction is commercially important: unlimited access can hide weak use cases as easily as it can accelerate good ones.
Why access and competence are different controls
A licence confirms that an employee may use a tool. It does not show that the employee can judge its output. In regulated or high-consequence work, that gap matters because a polished response can still contain an incorrect calculation, unsupported claim or missed exception. A new hire may also lack the context to recognise when an AI system has silently crossed a policy boundary.
Valon's approach is strict, and it will not suit every role. Used badly, it could slow onboarding or turn managerial discretion into an inconsistent gate. Used carefully, it expresses a sound principle: AI should amplify demonstrated judgement, not substitute for the knowledge required to supervise it. NIST's AI Risk Management Framework similarly treats trustworthiness as something organisations must address across design, deployment, use and evaluation, rather than as a property of model access alone.
Build a graduated AI privilege model
Replace the binary choice between universal access and a blanket ban with a role-based progression:
- Learn: complete representative tasks without AI and demonstrate the relevant process, policy and escalation rules.
- Assist: use AI for bounded drafting, search or classification while every material output receives human review.
- Operate: use approved workflows with logged prompts, sources, exceptions and sampled quality checks.
- Automate: allow higher autonomy only where acceptance criteria, rollback and an accountable owner are explicit.
- Revoke: reduce access when the role, model, data sensitivity or observed error rate changes.
Measure judgement and value, not token volume
A competence gate needs observable evidence. Test whether an employee can find deliberately planted errors, explain why an output is unsafe, identify the source needed for verification and route an exception correctly. Calibrate these checks by role: a finance analyst, customer-support specialist and software engineer should not face the same scenarios.
Then pair quality with economics. Track accepted output per dollar, rework, review time, exception rate, policy breaches and time to competence. Falling token spend is not automatically progress if staff spend longer completing work; rising spend can be justified if it produces reliable throughput or reduces costly errors. The unit of value is approved work, not prompts generated.
What business leaders should do next
Map each role to the decisions AI can influence, the harm an error could cause and the review already present. Introduce staged privileges for the highest-risk tasks first, publish the criteria for progression and give employees a clear route to regain access. Review the gate itself for consistency, bias and unnecessary delay.
ELYMENT AI's approval-workflow guide explains where human authorisation belongs, while the AI work-brief template turns quality expectations into a reusable operating contract. Our analysis of Workday's AI sales shows why adoption should be linked to measurable business outcomes. ELYMENT AI can help teams design a practical privilege model that joins competence, evidence, cost and accountability without making AI governance an onboarding bottleneck.
Sources
- Andrew Wang: We turned off AI access for new hires (2026-08-18) - Primary statement from Valon's chief executive describing the non-engineering new-hire access restriction.
- Business Insider: Valon makes most new hires earn AI access (2026-08-29) - Independent interview covering the policy, engineering exemption, managerial competence gate and Valon's projected token-spend reduction.
- NIST AI Risk Management Framework (2023-01-26) - Authoritative voluntary framework for managing AI trustworthiness across design, development, use and evaluation.
- Valon: About (2026-08-30) - First-party company information on Valon's leadership, regulated mortgage technology work and operating principles.
Continue learning
Frequently asked questions
What is an employee AI access policy?
It defines which people and roles may use approved AI tools, for which tasks and data, under what review, logging and escalation requirements.
Should new employees be blocked from AI?
Not universally. Businesses should match access to task risk and use staged privileges where employees must first demonstrate the knowledge needed to supervise AI output.
How can a manager test AI competence?
Use role-specific exercises with planted errors, source-verification requirements and escalation scenarios, then measure whether the employee identifies problems and explains the correct response.