4.1 DLP for GenAI
How to detect and control sensitive data moving into prompts, files, tools, connectors, and outputs where classic DLP often lacks visibility.
Last reviewed: August 18, 2026
DLP for GenAI: what security teams need to know
AI changes the DLP problem because the exit point is often a prompt, a file upload, a connector call, a browser action, or an API request. The same sensitive record can move through several of those surfaces in one session.
Effective GenAI DLP combines content detection with context. The policy should know which user, app, destination, connector, action, and data class are involved.
Common DLP for GenAI security failures
The control sees the browser but not the desktop app or CLI.
A paste is blocked, but the same data moves through a file upload.
Tool parameters and outputs are not inspected.
The DLP rule sees a secret but cannot tell whether the destination is approved.
Users move to personal accounts when enterprise tools are blocked.
DLP for GenAI security controls checklist
Map all AI data entry points: prompt, paste, upload, connector, browser, desktop, and API.
Classify data before deciding which AI surfaces may receive it.
Inspect tool parameters and outputs where telemetry allows it.
Use block, warn, justify, and allow modes based on data class and destination.
Review incidents for bypass paths across blocked and allowed events.
Anthropic
Overview
Anthropic's enforcement points sit in roles, connector policy, and managed settings rather than in a single DLP console. Enterprise custom roles gate capabilities per surface — chat, web search, skills, Claude Code, Cowork, and Claude for Chrome — and connector permissions can require approval, block access, or always allow it. The organization-wide per-tool policy acts as a ceiling: role grants can narrow access within it but cannot widen it, and enforcement fails closed toward denial.
On the desktop, Team and Enterprise owners can enable or disable public desktop extensions, and enterprise policy controls override in-app allowlist and blocklist settings. Cowork and the Claude Office add-ins need separate telemetry paths: both are outside the Compliance API today, while Anthropic offers OpenTelemetry exports that can include full prompts, tool parameters, file paths, document URLs, and user identity. Configure filtering, access, and retention before that stream reaches a broad SIEM index.
Claude Tag moves the DLP boundary into Slack channels. Channel members share the agent's Access bundles, memory, repositories, and service-account authority, while direct messages use personal connectors. Restrict who can invoke it, keep sensitive credentials and repositories out of organization-wide bundles, and include Slack retention, Agent Proxy destinations, and target-system logs in the data-flow review.
Anthropic documentation
Applicable Harmonic guides for Anthropic
OpenAI
Overview
OpenAI's closest DLP primitives are Lockdown Mode, RBAC, and app action controls. Lockdown Mode limits outbound web and external-service access to reduce prompt-injection data exfiltration, and admins assign it through RBAC roles; note that it does not affect Codex network access, so Codex needs its own egress controls. RBAC custom roles also gate apps, GPTs, canvas networking, and skills per group.
For connected apps, action control determines whether an app can read only, take actions, or use a custom set of actions. ChatGPT Work, ChatGPT for Excel or Google Sheets, and ChatGPT for PowerPoint can carry approved apps and skills into document workflows, so DLP must follow the source file, connected app, generated artifact, and final share. OpenAI's Work guidance says the Compliance API covers user messages and responses across Chat, Work, and Codex, but not files, actions, or tool calls.
OpenAI documentation
Applicable Harmonic guides for OpenAI
Frequently asked questions about DLP for GenAI
What is GenAI DLP?
GenAI data loss prevention is the set of controls that detect and govern sensitive data moving into and out of AI tools such as ChatGPT, Claude, Copilot, and Gemini. It inspects prompts, pasted text, file uploads, connector and tool calls, and generated outputs rather than just email and web traffic. The decision logic pairs content detection with context: which user, account type, surface, and destination are involved.
Why does classic DLP miss AI risk?
Classic DLP focuses on email, web uploads, and storage, so it tends to see the browser but not desktop apps, CLIs, connectors, or API traffic. AI workflows move the same record through several of those surfaces in one session, and tool parameters or model outputs are rarely inspected at all. Coverage needs to follow the surface list, not the network perimeter.
Should DLP block all sensitive data in AI tools?
No. Blanket blocking pushes users toward personal accounts, which is usually a worse outcome than monitored enterprise use. Match the response — block, warn, justify, or allow — to the data class, the destination, the user's role, and whether the surface is an approved enterprise tenant.
What should be monitored first?
Start with secrets and credentials, regulated records, customer data, source code, and financial data, plus any use of personal accounts for corporate work. These classes produce the highest-impact incidents and the clearest policy decisions. Expand into lower-sensitivity classes once triage keeps up with the alert volume.
How should DLP alerts be triaged?
Triage on data class, destination, and account type first: a secret sent to a personal account outranks internal data in an approved workspace. Then check whether the event created a durable external copy, such as a shared artifact or a connector write. Close the loop by reviewing blocked and allowed events together to spot bypass paths.
Applicable regulations and frameworks
G.1 Map your controls to NIST AI RMF and CSF 2.0
This article supplies implementation evidence for the NIST AI RMF and matching NIST CSF 2.0 outcomes.
G.3 DORA and AI resilience in financial services
Conditional: for a DORA-regulated workflow, this supports data protection, integrity, and third-party service review.
G.5 SANS Critical AI Security Guidelines mapping
This article implements relevant SANS Data Protection guidance.
G.6 Write an AI Acceptable Use Policy that holds up
This article supplies a technical or process control used to enforce the acceptable-use policy.
G.7 Ownership and RACI for AI security
This control depends on the ownership and evidence responsibilities defined in the RACI.
G.9 HIPAA controls for AI systems handling PHI
Conditional: for a workflow handling ePHI, this supports HIPAA PHI identification, minimum-necessary handling, retention, and disclosure controls.
G.2, G.3, G.4, and G.9 are conditional mappings. They apply only when the deployment is within the legal or regulatory scope described on the linked governance page.
Related handbook guidance
Was this helpful?