Shadow AI and prompt DLP

Test data-egress decisions without retaining the submitted prompt.

What the baseline contains

12 structured records from P07_Shadow_AI. The source workbook is a historical portfolio model, not verified operational evidence.

What is implemented

Local pattern screening detects selected email and credential patterns. MCP returns counts and a recommendation without persisting raw prompt text.

Inspect the engineering

engine/decisions.py:inspect_prompt in the downloadable repository package. Open the executive observatory to inspect the modeled risk register and current technical snapshot.

Decision boundary

This is a bounded local screening demonstration. It does not discover shadow AI across a company, inspect browser traffic, or enforce network egress.

Review procedure

1. Establish system scope, owner, observation period and evidence provenance.
2. Execute the applicable check and inspect unknown, stale or failed results.
3. Record an evidence-linked finding, assign a treatment owner and set a review date.
4. Retest with new evidence. Keep the earlier snapshot and the reviewer’s conclusion.