Data Loss Prevention

Data Loss Prevention, commonly abbreviated DLP, protects sensitive information from leaving its permitted boundaries. Those boundaries may be a tenant, application, organization, geographic region, or approved set of recipients. A practical DLP policy identifies the data being protected, who may use it, which destinations are allowed, and what happens when a violation is detected. Depending on the situation, enforcement can block a request, redact selected fields, quarantine an object, or alert an investigator.

Start with discovery and classification. Engineers need to locate personal information, payment data, credentials, confidential documents, and other protected content across object storage, databases, application payloads, and telemetry. Detection may use predefined identifiers, custom patterns, checksums, or contextual analysis. Classification labels and resource tags help express policy, but tags alone do not inspect content or prevent disclosure. Likewise, discovering sensitive files does not automatically stop their download or transmission.

In cloud workloads, apply complementary controls around storage, identities, application interfaces, and outbound traffic. Restrict access to sensitive datasets, prevent unintended public access, and permit transfers only to approved destinations. Inspect relevant content at application boundaries where it is available in plaintext. Encryption protects information against interception or unauthorized storage access, but it does not prevent an authorized application from decrypting information and sending it to an inappropriate recipient. Network destination restrictions reduce exfiltration opportunities without necessarily recognizing sensitive content.

Generative AI applications introduce additional disclosure paths. Users can submit sensitive material in prompts, retrieval-augmented generation can insert confidential documents into model context, and an agent can send information to external tools. Model responses, conversation histories, caches, traces, and invocation logs can also become secondary copies of protected data. Minimize the information supplied to the model, tokenize or redact fields where practical, and inspect both inputs and outputs. Keep credentials outside prompts and system instructions; a system prompt is not a secure secret store.

For example, a customer-support assistant might need an order status but not a customer's complete payment details. Authorize the user's access before retrieving order records, select only necessary fields, and inspect the assembled request before model invocation. Inspect the response before releasing it, and redact sensitive values from logs separately. If the assistant can call an external ticketing tool, validate the tool destination and payload in application code. A model-generated tool call must not be treated as proof that the transfer is authorized.

These controls address the OWASP risk of sensitive information disclosure and complement protections against prompt injection and excessive agency. Treat retrieved documents and tool results as untrusted data rather than instructions. Enforce tenant isolation and document-level authorization outside the model, and restrict agent permissions to the actions required for the task. Content guardrails can reduce disclosure risk, but they do not establish authorization or reliably defeat every injection attempt. Do not assume output filtering can undo information already transmitted to a model or tool.

DLP introduces trade-offs in latency, cost, accuracy, and usability. Pattern matching can flag harmless text or miss encoded, fragmented, multilingual, or context-dependent disclosures. Streaming responses require particular care because sensitive content released before inspection cannot be recalled. Test policies with realistic data and adversarial prompts, measure false positives and false negatives, and define what happens when inspection fails or times out. High-risk transfers may require blocking when inspection is unavailable. Keep exception approvals auditable, restrict access to findings, and avoid retaining raw sensitive payloads merely to investigate a DLP event.