Troubleshooting

The common problems, what causes them and how to fix them. If none of these fits, email hello@prism-dlp.com with what you see and when it started.

Quick checks

Nothing shows up under Incidents

Work down the list:

1. Is the console filtered? Incidents shows the last 24 hours and only what Prism flagged or detected. Set Time range to All time and paste the test key above. A plain paste with nothing in it isn’t an incident.
2. Has the trial ended, or is a payment failing? When billing lapses, Prism stops checking and records nothing, and a banner says so. Sensors still look healthy: the extension’s Test connection says “Connected” and Macs still say “Checked in”. See Billing.
3. Was the key revoked or mistyped? On Set up, check the key is in the list and not marked revoked. The extension’s settings page (extension menu → Options → Test connection) says “Prism rejected this key” for a wrong or revoked key. The Mac menu says “Prism didn’t accept this Mac’s key”.
4. Is the site watched? Under Destinations, the tool must have Watch ticked. With Only approved AI tools on, unapproved tools are refused, which does show up as an incident.
5. Is there an email? Both sensors stay idle without one. See “Not configured” below.
6. Is it a private window? Extensions don’t run in Incognito or InPrivate unless you allow them. The Jamf and Windows files on Set up turn Incognito off; at chrome://policy, check IncognitoModeAvailability is applied.
7. Is the browser managed? On an unmanaged Chrome, the person can switch the extension off.

The extension

• “Some settings are managed by your organisation” on the settings page is expected: fields set by policy can’t be changed there.
• $EMAIL instead of an email: Jamf didn’t fill the variable because the Mac has no assigned user (Inventory → User and Location). Prism ignores an unfilled variable and uses the signed-in Chrome profile’s email instead. If there’s none, the extension does nothing.
• “Couldn’t reach Prism”: check the API URL is https://api.prism-dlp.com and the network allows it. Firewalls and TLS-inspecting proxies must let the browser reach that address.
• Pastes go through when Prism is down. That’s by design: if Prism doesn’t answer within about 0.6 seconds, the paste goes ahead and is recorded when Prism is back. Uploads Prism couldn’t check follow Detectors → Files Prism can’t read.
• “Checked by Prism. Paste the file again to attach.” Some sites don’t take a file back after Prism has checked it. Pasting or dropping the same file again within 30 seconds goes straight through.
• Changes take a while to reach browsers. Checks use new settings within 30 seconds, but the list of watched sites refreshes every 15 minutes.
• People can’t remove it. That’s what force-install does. To remove it, take it out of the ExtensionSettings policy.

The Mac agent

What its menu and setup window say, and what to do:

• A Mac doesn’t appear under Macs and PCs. It hasn’t checked in: look at its menu for one of the messages above. Macs check in every 15 minutes and when paste protection changes.
• A USB copy wasn’t recorded. Check Settings → Desktop agent → Record files copied out and the location’s tick, and that the permissions profile (Removable Volumes) is installed. Copies are recorded after they happen; Prism can’t stop them yet. Network shares aren’t covered.
• Files dragged into the Claude or ChatGPT app aren’t checked. That’s a known gap: the agent sees Cmd+V and menu pastes, not drag-and-drop or the attach button in desktop apps. In the browser, the extension does check them.
• The log is at ~/Library/Logs/Prism DLP.log on each Mac. It records file copies and clipboard checks, never what was pasted.

Observe mode shows “Allowed” for something Prism would block

In Observe mode nothing is blocked: every match is recorded as Allowed, and the incident’s Why section keeps Prism’s own decision (for example verdict deny … mode observe). Switch to Warn or Enforce under Settings when you’re ready. Copies to USB and cloud folders always show Allowed with “Recorded after it happened”, because Prism can’t stop them yet.

Someone is blocked and shouldn’t be

• For one person, for a while: open the incident → Allow for a while… (see Exceptions).
• For everyone: change the tool’s status under Destinations, the detector’s severity under Detectors, or add an Approved workflow under Settings.
• An exception doesn’t apply. The person’s email must come from your device management or their Chrome profile, not one typed into Prism’s settings, and they need extension 0.1.2 or Mac agent 0.2.2 or later. Exceptions never cover Work only rules or prompt-injection blocks.
• “Personal account” on a work account. Add the company’s email domain, ChatGPT workspace ID or Claude organisation ID under Destinations → Work accounts.

Console sign-in

• No sign-in email: the email link only goes to people who already have a login. Ask an admin to invite you (People), or use Continue with Google or Continue with Microsoft.
• “This invitation doesn’t work any more”: it expired (7 days), was used, or a newer one was sent. Ask for it to be sent again.
• “Microsoft or Google didn’t share an email address”: your IT team needs to set the Email field on your account, or use an email link.
• Everything is read-only and saving fails: the organisation is read-only until it subscribes. See Billing.

Updated 13 October 2026