{"id":"GRD-001","section":"Runtime Guardrails","requirement":"Inspect prompt content in real time before submission","acceptance":"Classify typed or pasted content at submit time and reach a policy decision before content leaves for the provider.","tier":"AT0–AT4","whyItMatters":"A decision made after submission only tells you what was lost. Inspection before submission is what prevents the loss.","verificationMethod":"LT","verificationTest":"Sensitive pilot prompts receive a policy decision before they reach the provider; record the decision time.","formerly":"DAT-001","alsoIn":[],"sort":11,"adoptionContext":"Prompt inspection applies across the listed employee interaction contexts, including personal accounts and agent-assisted work, wherever the submission path is observable.","mappings":[{"frameworks":["csf"],"explanation":"Classifying prompts at submission supplies timely inputs for protecting data in use and in transit. A pre-egress policy decision does not by itself demonstrate that the protective action is executed.","kind":"framework","references":{"csf":["PR.DS-02","PR.DS-10"]},"relation":null,"conditions":[]},{"frameworks":["soc2","iso27001"],"explanation":"Classification and a policy decision before provider egress supply inputs to leakage restrictions and governed transfers. The acceptance test requires a decision, not execution of a block; enforcement must be supplied separately.\nISO/IEC 27001: A.8.12: Operate inspection in a leakage-protection workflow with defined alert triage, warnings, blocking or another protective response matched to the buyer’s policy.","kind":"framework","references":{"soc2":["CC6.7"],"iso27001":["A.8.12","A.5.14"]},"relation":null,"conditions":[]},{"frameworks":["rmf"],"explanation":"The pre-submit policy decision can implement part of a planned AI risk response when linked to the buyer’s documented priorities. Inspection alone does not show that the selected response is carried out.","kind":"framework","references":{"rmf":["MANAGE 1.3"]},"relation":null,"conditions":[]},{"frameworks":["iso"],"explanation":"A pre-submit policy check helps operationalize responsible-use rules for prompts. It must be connected to the buyer’s rule and response process to govern use effectively.","kind":"framework","references":{"iso":["A.9.2"]},"relation":null,"conditions":[]}],"area":"Runtime Guardrails","areaSlug":"GRD","url":"/r/GRD-001","frameworkRefs":{"ISO27001":["A.8.12","A.5.14"],"ISO42001":["A.9.2"],"NIST-CSF":["PR.DS-02","PR.DS-10"],"NIST-AI-RMF":["MANAGE 1.3"],"SOC2":["CC6.7"]}}