Security playbook · AI Employee: Sig

Restricted-Country Access Control

Zero unauthorised access from restricted regions

Install this playbookBack to marketplace
The problem

Some countries are restricted for compliance reasons: OFAC-sanctioned countries, embargoed regions, jurisdictions with export-control implications, high-risk fraud regions. When employees travel to (or connect from) restricted countries, corporate systems shouldn't grant access without additional review. Manual geo-block enforcement is inconsistent; some systems check IP, some don't; access from restricted regions happens accidentally + creates compliance exposure.

At a glance
Trigger
Monitor event
Approvals
Security approves exceptions
What it does
Writes to your systems
Systems
Okta · EDR · GeoIP
How it feels in production

An hour-by-hour walkthrough.

Priya travels to a restricted country for personal reasons. Her laptop attempts to access corporate systems from the new location. Sig detects: - New login from IP geolocated to restricted country (per OFAC list) - Priya's user profile: no travel booking on record - Impossible-travel signal (Priya was in Berlin 4 hours ago) Sig immediately: - Blocks access to restricted-scope systems (customer data, payment systems, regulated data) - Allows access to safe systems (public docs, email, calendar) with elevated logging - DMs Priya via authenticated channel: "Access from [country] detected. Corporate policy restricts most access from this region. I've blocked restricted systems; safe systems remain accessible. Are you travelling here for personal reasons?" - Notifies security team + Priya's manager for context Priya confirms personal travel. Sig maintains restriction until she returns; logs the incident for compliance record. Restricted-country access-control policy enforced without preventing legitimate personal travel + basic email access.
How it works

Step by step.

  1. 01

    Detect access from restricted country

    IP geolocation + user profile + travel booking cross-check. OFAC list + custom restricted-region list applied.

    IP geolocation · OFAC list · Travel bookings
  2. 02

    Apply tiered restrictions

    Not all-or-nothing. Regulated data blocked; general email + docs allowed with elevated logging.

    Access control policies · Data classification
  3. 03

    Notify user + security via authenticated channel

    SMS to verified phone (out-of-band). Prevents attacker-controlled channel from seeing the notification.

    Twilio · Verified phone · Security notification
  4. 04

    Log incident for compliance record

    Full timeline, access attempted, actions taken. Retained for regulatory response.

    Audit log · Compliance retention
  5. 05

    Restore access on return

    User returns to permitted region; access restrictions lift. Audit trail of restriction period preserved.

    Access control · Audit log
Systems and wiring

What you connect to make this run.

IP geolocation · MaxMind · IPinfo

read

Country + region from IP. Multi-source verification to reduce false positive from VPN endpoints.

OFAC sanctions list · Custom restricted regions

read

Regulatory + business-defined restricted regions. Kept current with sanctions updates.

Okta · Access control

read+write

Session control per region. Tiered access enforcement.

Twilio · Verified phone

write

Out-of-band notification. Prevents attacker-in-corporate-account from suppressing alerts.

What changes

Before and after, honestly.

% of restricted-region access attempts detected + acted on
Before
30-60%
After
99%+
Time from restricted-access detection to block
Before
Hours (post-hoc discovery)
After
Under 30 seconds
Compliance exposure from restricted-region access
Before
5-15 incidents per year
After
0-1 per year
False-positive impact on legitimate personal travel
Before
Complete access loss
After
Basic access retained
Related

Playbooks that pair with this one.

Security

Anomalous Login

Restricted-region detection is one signal in fusion score.

Security

Incident Response Orchestration

Restricted-region access may promote to incident based on scope.

HR

Time Off & Leave Requests

PTO with travel destination informs allowed-region context.

Frequently asked

Answers about this playbook.

What if legitimate business travel to restricted region is planned?

Business-travel request path with legal + compliance review. Approved travel gets scoped access exception; export-control review as needed.

How does it handle VPN traffic that appears from unexpected region?

VPN detection + user's known VPN endpoints. Corporate VPN doesn't trigger; personal VPN from restricted region does.

What about employees who normally work from restricted regions?

Employment-location-appropriate policies. Employee based in region has access per employment; not restricted the same way.

How does it interact with export controls (ITAR, EAR)?

Export-controlled data has additional per-country restrictions. Access decision incorporates export-control classification.

What about accidental Cloudflare / CDN geolocation errors?

Multi-source verification reduces error. Single-source suspicious geolocation triggers user confirmation, not immediate block.

See it run on your data.

Free plan, no credit card. Connect the systems this playbook needs and run it against a past event first.

Book a demoMore Security playbooks