Gateway policy, inspection, and DLP

Write a decision table

For each request class, define subject, purpose, data classification, input type, destination, model or tool, permitted actions, limits, inspections, transformations, approval, evidence, and failure behavior.

Policy decisions may allow, deny, redact, tokenize, transform, rate-limit, route, quarantine, or require human approval. Make rule priority and conflict resolution deterministic.

Inspection limits

Inspect structured fields, prompt text, files, metadata, tool arguments, and responses as appropriate. Pattern, classifier, and model-based detectors all have false positives, false negatives, language limits, and evasion risks. Layer controls and never claim complete DLP coverage.

Test encoding, splitting, archives, images, mixed languages, indirect references, streaming fragments, oversized inputs, malformed structures, and adversarial instructions. Decide whether transformation changes meaning or evidence.

Evidence and privacy

Record policy version, rule and reason code, action, timing, actor and destination references, approval, and correlation ID. Avoid storing raw sensitive content when hashes, categories, bounded samples, or protected forensic capture meet the purpose.

Administrative overrides need narrow scope, expiry, independent review, and visible evidence.