# GRD-001: Inspect prompt content in real time before submission


- Area: Runtime Guardrails

- Verification: Live test
- OWASP adoption tier: AT0–AT4
- Formerly: DAT-001
- URL: /r/GRD-001

**Acceptance criteria:** Classify typed or pasted content at submit time and reach a policy decision before content leaves for the provider.

**Why it matters:** A decision made after submission only tells you what was lost. Inspection before submission is what prevents the loss.

**How to verify:** Sensitive pilot prompts receive a policy decision before they reach the provider; record the decision time.

**OWASP adoption context:** Prompt inspection applies across the listed employee interaction contexts, including personal accounts and agent-assisted work, wherever the submission path is observable.

**Mappings:**
- NIST CSF 2.0: PR.DS-02, PR.DS-10 — Classifying prompts at submission supplies timely inputs for protecting data in use and in transit. A pre-egress policy decision does not by itself demonstrate that the protective action is executed.
- SOC 2: CC6.7; ISO 27001: A.8.12, A.5.14 — Classification and a policy decision before provider egress supply inputs to leakage restrictions and governed transfers. The acceptance test requires a decision, not execution of a block; enforcement must be supplied separately.
ISO/IEC 27001: A.8.12: Operate inspection in a leakage-protection workflow with defined alert triage, warnings, blocking or another protective response matched to the buyer’s policy.
- NIST AI RMF: MANAGE 1.3 — The pre-submit policy decision can implement part of a planned AI risk response when linked to the buyer’s documented priorities. Inspection alone does not show that the selected response is carried out.
- ISO 42001: A.9.2 — A pre-submit policy check helps operationalize responsible-use rules for prompts. It must be connected to the buyer’s rule and response process to govern use effectively.