Acceptance criteria
Classify typed or pasted content at submit time and reach a policy decision before content leaves for the provider.
Why it matters
A decision made after submission only tells you what was lost. Inspection before submission is what prevents the loss.
How to verify
Sensitive pilot prompts receive a policy decision before they reach the provider; record the decision time.
OWASP adoption context
Prompt inspection applies across the listed employee interaction contexts, including personal accounts and agent-assisted work, wherever the submission path is observable.
Framework mappings
Classifying prompts at submission supplies timely inputs for protecting data in use and in transit. A pre-egress policy decision does not by itself demonstrate that the protective action is executed.
Classification and a policy decision before provider egress supply inputs to leakage restrictions and governed transfers. The acceptance test requires a decision, not execution of a block; enforcement must be supplied separately. ISO/IEC 27001: A.8.12: Operate inspection in a leakage-protection workflow with defined alert triage, warnings, blocking or another protective response matched to the buyer’s policy.
The pre-submit policy decision can implement part of a planned AI risk response when linked to the buyer’s documented priorities. Inspection alone does not show that the selected response is carried out.
A pre-submit policy check helps operationalize responsible-use rules for prompts. It must be connected to the buyer’s rule and response process to govern use effectively.