Prompt DLP: how sensitive data is caught before it reaches a model

A control on the path between the user and the AI service decrypts the request, extracts the prompt text and any uploaded files, and runs classifiers over them: patterns for card numbers and keys, dictionaries for project names, and increasingly language models that recognise context, such as a contract clause or a medical note. The result is matched against a policy that decides what happens next. The same can run on the response, to stop a model from returning data the user should not see.

Blocking is the bluntest response: the whole prompt stops. It is safe, and it is also how people learn to route around the control. Redaction removes or masks the sensitive part, such as a customer name or an account number, and lets the rest through, so the work continues. Coaching shows a warning and lets the person decide. On the pages we read, Cato lists Monitor, Anonymize and Block as its policy actions, Zscaler states it filters sensitive data from LLMs, and Palo Alto Networks and Fortinet describe coaching. The ActionStrip on each profile shows which responses each vendor states.

Source: Cato Networks: AI security · Read 7 Oct 2026

It only sees prompts that pass through it. AI used on a personal phone, an AI feature inside a desktop app that talks to its vendor over a pinned connection, or an agent that calls a model from a server outside the inspected path will not reach it. Classifiers also miss context: a paraphrased secret is still a secret. Treat prompt DLP as one layer next to an approved-tools list and contracts with the AI providers you allow.

Paste realistic samples from your own data classes and check what is caught, what is masked and what the person sees. Measure false positives on ordinary work, because a control that interrupts too often gets bypassed. And check where prompts and verdicts are logged, since a log of every prompt is itself sensitive data.

Start with the classes that are easy to recognise and costly to lose: credentials and API keys, payment card numbers, national identity numbers, customer records and source code from private repositories. They have clear patterns and a clear owner, so false positives are easier to tune. Add context-heavy classes, such as contract terms or product plans, once the basics work, and expect to spend more time tuning them.