How Prism decides

Every paste, upload, typed message and file copy that Prism DLP checks gets a decision from three inputs: what the detectors find in the content, the settings you chose for the tool, the account and each detector, and what Prism’s own judgement model makes of the text. Your mode then decides what the person sees.

This page explains that reasoning, so you can answer “why did it warn?” and “why didn’t it?”. For where each setting lives, see Using the Prism console. For step-by-step fixes, see Troubleshooting.

In short

• Detectors look for exact patterns: API keys, private keys, passwords in config, payment card numbers, bank details, NHS, National Insurance, passport, driving licence and hospital numbers, dates of birth, email addresses, phone numbers, and the keywords and codes you add under Detectors. Each one has a severity (low, medium, high or critical). Every value found is replaced with a placeholder such as [AWS_KEY_1] before anything is stored, queued or logged.
• Your settings are each tool’s status under Destinations (Approved, Checked or Blocked), Work only, the severity of each detector, Files Prism can’t read, and any exceptions.
• Prism’s judgement model reads the text only after the placeholders are in. We trained it on text written for the purpose, never customer data. It runs on our servers in the EU (Railway, Netherlands) and keeps nothing. It judges three things: whether the text looks confidential, whether it looks like someone moving data out on purpose, and whether it tries to give the AI tool instructions (prompt injection). It can turn an allowed action into a warning. It never blocks on its own.

The mode under Settings → What happens when Prism finds something (Observe, Warn or Enforce) then turns the decision into a block, a warning or nothing at all.

The order Prism checks things in

Prism works through these steps in this order. Steps 1 to 4 can settle the decision on their own, and when one does, the steps after it are skipped. Exceptions are always looked at last.

1. Work-only tools and personal accounts

If a tool is marked Work only under Destinations and the person is signed in with a personal account, Prism blocks the action whatever it contains. The same happens when Prism can’t tell which account is signed in and If Prism can’t tell which account is signed in is set to Refuse it (safer). With Allow it and record it, an unconfirmed account carries on to the next step.

The incident shows “Personal account (work only)” or “Unconfirmed account (work only)”. The model isn’t asked.

2. Blocked tools

A tool marked Blocked is refused whatever is in the paste. With Only approved AI tools chosen, every AI tool you haven’t marked Approved is refused the same way. The incident shows “Destination not allowed”, with a detail such as “grok.com is blocked by your organisation” or “grok.com isn’t one of your organisation’s approved AI tools”. The model isn’t asked.

A blocked tool with Test ticked is treated as Checked: nothing is refused, and the incident records “Test rule (not enforced)” so you can see what the block would have caught.

3. Files Prism can’t read

Scanned PDFs, password-protected files, older Office formats, video and files over 20 MB can’t be read. When nothing at all was found in such a file, Detectors → Files Prism can’t read decides:

A file Prism could only partly read is checked on the part it read, and the incident says “File partly checked”.

4. What the detectors found

The highest severity found sets how much the content weighs:

• Critical (live AWS, OpenAI, Anthropic, Stripe, GitHub and Slack keys, private keys, database connection strings): blocked in any of Prism’s listed AI tools that you haven’t approved, whatever the model thinks.
• High (card numbers, bank details, ID numbers, Google API keys, passwords in config): a warning or a block, depending on where it’s going and how the model reads the intent.
• Medium (dates of birth, Stripe test keys, random-looking tokens): a warning at most, and only when the destination and the model’s read of the intent add enough risk.
• Low (email addresses, phone numbers): never a warning on its own. The value is still replaced with a placeholder, and the model sees that it was there.

You can change any built-in detector’s severity, or switch it off, under Detectors.

Approved tools still don’t get secrets. While Even in approved AI tools, block secrets, card and bank details and ID numbers is ticked under Destinations (it starts ticked), a high or critical secret, card number, bank detail or government or health ID number is blocked even in an Approved tool. The incident shows “Secret, bank, card or ID number sent to an approved tool”. A date of birth in an approved tool gets a warning first. Your own detectors with Block in approved AI tools too ticked are blocked in approved tools whatever that setting says.

5. The model’s three judgements

Next the model reads the redacted text and answers its three questions. Each judgement has its own threshold, and any one above it raises the result to at least a warning:

None of these can turn an action into a block. A block always comes from a detector, a blocked tool, a work-only rule, the unreadable-files setting or failing closed.

6. Risk from the destination and the intent

The destination and the model’s read of the intent decide how much a detector match counts. A tool you haven’t approved adds risk (“Untrusted destination: grok.com is an AI tool your organisation hasn’t approved”), and so does a personal account. An Approved tool, or a domain listed under Settings → Approved apps, adds almost none. Intent read as routine work adds little; intent read as convenience, an accident or deliberate removal adds more.

This is why the same high-severity match can warn in one case and block in another. With nothing found by the detectors, this step adds nothing: only the model’s judgements in step 5 can raise a warning.

Approved workflows under Settings don’t change any decision yet. Prism’s own model doesn’t read them.

7. Exceptions

If the result is a warning or a block, Prism checks for an exception in force for that person and tool. A matching exception lets the action through, and the incident shows “Allowed by exception” with who granted it, until when and why. Prism’s own decision stays on the incident.

An exception covers a detector match only when every kind of data found is ticked under What it covers. Anything else Prism flags covers the rest, including the model’s judgements, but never Secrets and API keys or Payment card numbers: those must be ticked themselves. When the detectors found nothing and the model raised the warning, only Anything else Prism flags covers it. If the model also judged the text confidential, a tick for Personal data alone isn’t enough.

A blocked tool needs This tool, even if it’s blocked, and what the person sends is still checked against the other ticks.

Three things are never covered: prompt injection, work-only rules, and a block because the model was unreachable and your organisation fails closed. Exceptions also apply only when the person’s email comes from your device management or their signed-in Chrome profile.

Decisions and what the person sees

Prism makes one of four decisions. The incident’s Why section shows it on its last line, for example verdict deny, risk 65%, confidence 100%, mode block, and the severity badge reflects it:

For the other three, the mode decides what happens. The mode on that line uses the internal names: observe, coach for Warn and block for Enforce.

A warning shows what was found and lets the person continue, with a reason if Ask for a reason before continuing is ticked. In Observe, nobody sees anything, and Prism’s decision is kept on the incident so you can see what Warn or Enforce would have done.

Copies to USB drives and cloud folders

The Mac agent records files copied to USB drives, external disks and cloud-sync folders after the copy has happened. Prism still decides as above and keeps that decision on the incident, but a copy always shows as Allowed. When Prism would have warned or blocked, the incident adds “Recorded after it happened”, because Prism can’t stop copies to USB drives or cloud folders yet.

When Prism or the model can’t be reached

The model doesn’t answer. While someone is waiting, Prism gives the model 0.4 seconds. If it doesn’t answer in time, the detectors and the destination decide without it, and Settings → If the decision model is unreachable covers the rest:

• Allow and flag (the default): the detectors and the destination still decide. A high or critical match in an AI tool you haven’t approved is blocked, and a medium one warned. Anything else is allowed and recorded with “Model unavailable, allowed”.
• Block: everything is treated as a block, with “Model unavailable, blocked”: blocked in Enforce, warned in Warn. No exception covers it.

Prism can also fail closed for particular groups of people only. That choice isn’t in the console yet.

The browser extension can’t reach Prism. If Prism doesn’t answer within about 0.6 seconds (longer for long text, up to about 4.6 seconds), the paste goes ahead and the event is sent to be recorded. An upload whose check couldn’t finish counts as a file Prism couldn’t read, so Files Prism can’t read applies. See Pastes went through while Prism was down.

Why something went through without a word

When someone expected a warning and didn’t get one, it’s usually one of these:

• Nothing was found. No detector matched, and the model didn’t judge the text confidential, deliberate or an instruction to the AI tool.
• The tool is Approved. Confidential-looking text doesn’t warn in an approved tool. Secrets, ID numbers, and card and bank details are still blocked and dates of birth still warned (while Even in approved AI tools, block secrets, card and bank details and ID numbers is ticked), and deliberate-looking moves and prompt injection still warn.
• The mode is Observe. Everything is allowed and recorded. Open the incident to see Prism’s own decision.
• Work only isn’t ticked for that tool, or unconfirmed accounts are set to Allow it and record it.
• The file couldn’t be read and Files Prism can’t read is on Allow, and record them as not checked.
• The match was low severity, or the detector is switched off or in test mode.

Allowed events with nothing found don’t appear under the default Flagged and detected filter. Set the severity filter to Low (allowed) to find them. For the full checklist, see I uploaded a file and nothing happened and A tool set to Work only let a personal account through.

Three examples

An AWS key pasted into ChatGPT

ChatGPT is Checked (not approved, not work only), the person is on their work account and the mode is Enforce.

1. Work only and blocked tools don’t apply.
2. The AWS access key detector matches. It’s critical.
3. ChatGPT isn’t approved, so a critical match in it is a block, whatever the model reads.

Result: deny, Blocked. The Why section reads:

• Detector match: AWS access keys ×1
• Credential or secret: Live credential or secret in content
• Untrusted destination: chatgpt.com is an AI tool your organisation hasn’t approved

With Offer to paste with sensitive parts removed ticked, and the key the only problem, the dialog offers the same text with [AWS_KEY_1] in place of the key. In Warn the person is warned instead; in Observe it’s allowed and recorded. If ChatGPT were Approved, the key would still be blocked with the default setting, because approved tools still don’t get secrets.

A note about a colleague’s health pasted into Gemini

The note says a named colleague has been signed off with anxiety for four weeks. It has no ID numbers or dates of birth. Gemini is Checked, the person is on their work account and the mode is Enforce.

1. Work only and blocked tools don’t apply.
2. No detector matches, so the content adds no risk of its own.
3. The model reads the note. If it judges it confidential, it raises the result to a warning.

Result when the model judges it confidential: coach, Warned, never a block. If it doesn’t, the note is allowed. The Why section reads “Sensitive content: Looks confidential (… sure)” and “Untrusted destination: gemini.google.com is an AI tool your organisation hasn’t approved”. An exception would need Anything else Prism flags to cover it, since no detector found anything.

The same note in an approved tool

Now the note goes to ChatGPT, which you’ve marked Approved because your organisation uses ChatGPT Enterprise.

1. Work only and blocked tools don’t apply.
2. No detector matches.
3. The model may judge the note confidential, but in an approved tool that alone doesn’t warn.

Result: allow, Allowed, with “Low risk” on the incident. It would warn only if the model read it as someone moving data out on purpose, or as an instruction to the AI tool. Had the note included a date of birth after “DOB”, the person would have been warned first, with the default setting.

What the console shows for a decision

Open any incident under Incidents to see:

• Why: each reason in plain words, such as “Detector match: AWS access keys ×1”, “Personal account (work only): personal account on chatgpt.com”, “Looks deliberate: Looks like someone moving data out on purpose (81% sure)” or “Model unavailable, allowed”. The last line gives the decision, risk, confidence and mode.
• How the model read it: three panels, Would security mind it leaving?, Why was it moved? and Does it try to steer an AI?, with the model’s answer to each. “No model answer for this event; the detectors decided on their own” means the model wasn’t asked (a blocked tool, a work-only rule, nothing to read) or didn’t answer in time.
• Detectors: what was found and how many times.
• Analyst review: analysts can record what should have happened with Should allow, Should warn or Should block, a reason, and Save review. The review goes in the audit log. It doesn’t change what happened.

Admins also see Allow for a while… on warned and blocked incidents, which opens Exceptions with the person, tool and data filled in. See Using the Prism console.

Updated 19 October 2026