Acceptance criteria
Detect context and intent without depending on formatted identifiers, regex, file labels or exact keywords, and keep detecting when the user asks to translate, rewrite, summarize or reformat the same content.
Why it matters
Most valuable business information has no fixed format. Pattern matching misses it, and rewording defeats it.
How to verify
Unstructured sensitive text, including translated and reworded versions, is detected on default configuration.
OWASP adoption context
Semantic classification follows the business content across the listed employee AI contexts rather than relying on a particular application or account type.
Framework mappings
Recognizing sensitive meaning in prompts, including translated or rewritten content, supplies detection inputs for protecting data in use and in transit. Recognition does not itself stop transmission.
Where the recognized content includes personal data, semantic findings provide evidence for examining privacy risks. Security sensitivity alone is not a privacy assessment, and findings need documented evaluation.
Semantic classification helps identify designated confidential information and feed leakage rules and sensitivity categories. It does not define the buyer’s classification scheme or enforce egress restrictions; rewrite-resistant quality needs testing. SOC 2: C1.1: The Confidentiality category and relevant information must be in scope. ISO/IEC 27001: A.8.12: Use an operated leakage-protection workflow with defined alert triage, warnings, blocking or another protective response.