Acceptance criteria
Detect when an agent picks up sensitive content from one connnected tool and attemps to share it with a separate tool, even if the user prompt was benign.
Why it matters
Connectors pull sensitive data into a conversation even when the user's question is harmless.
How to verify
When an agent picks up sensitive information from one tool or dataset and attempts to share it with a different tool, the even is blocked if it violates policy.
OWASP adoption context
Embedded assistants, integrated platforms, citizen workflows and MCP extensions can retrieve sensitive data after a benign prompt; inspect the returned payload.
Framework mappings
Inspecting connector payloads reveals sensitive information entering a workflow even when the prompt is benign, supplying runtime evidence for transfer, confidentiality and leakage controls. Detection alone does not restrict later disclosure; finding sensitive content also does not establish poisoned context. SOC 2: C1.1: The Confidentiality category and relevant information must be in scope. ISO/IEC 27001: A.8.12: Operate inspection within a leakage-protection workflow with defined alert triage, warnings, blocking or another protective response.
Where retrieved content includes personal data, the findings inform examination of privacy risk within the AI workflow. Recognizing sensitive content is one input to that examination, not a complete privacy-risk assessment.