# GRD-002: Inspect file uploads before submission


- Area: Runtime Guardrails

- Verification: Live test
- OWASP adoption tier: AT0–AT3
- Formerly: DAT-005
- URL: /r/GRD-002

**Acceptance criteria:** Apply eligible detection models to uploaded files, summarize the alert, and document coverage differences between files and typed text.

**Why it matters:** Files carry far more data than typed prompts, and many tools treat uploads as a separate, weaker path.

**How to verify:** Sensitive DOCX, PDF, XLSX and CSV uploads are inspected before submission; coverage differences are documented.

**OWASP adoption context:** The listed shadow, assistant, platform and citizen-workflow contexts cover common upload paths; file-inspection support must be demonstrated for each eligible surface.

**Mappings:**
- NIST CSF 2.0: PR.DS-02; SOC 2: CC6.7; ISO 27001: A.8.12 — File inspection extends disclosure-detection inputs to uploads before submission. Alert summaries and file-versus-text coverage limits support transfer decisions, but inspection alone does not stop a prohibited upload.
ISO/IEC 27001: A.8.12: Use an operated leakage-protection workflow with defined alert triage, warnings, blocking or another protective response. Make unsupported formats, encryption and parser limits visible.
- NIST AI RMF: MANAGE 1.3 — Documented file-versus-text coverage differences inform the scope and limits of planned AI risk responses. They do not establish that an effective response is applied to every upload.
- ISO 42001: A.9.2 — Inspecting uploaded files provides a detection stage in an AI-input-use procedure. This link requires documented rules for prohibited input and an operated disposition for findings; inspection and alert summaries alone do not establish the whole procedure.