Employees paste source code and customer records into public generative AI chat tools. The company wants to keep allowing these tools but detect and block prompts that carry sensitive data, and also guard against prompt injection content in what users send. Which Secure Access capability fits?
Select an answer to reveal the explanation.
Short Explanation
Blocking AI outright is like banning email because people sometimes send the wrong attachment. AI guardrails in the DLP policy read the prompts and responses themselves, stopping sensitive data and injection attempts while you keep using the tools. The trap is the category block — it's safe, but it throws away the requirement to keep AI available.
Full Explanation
Cisco Secure Access provides AI guardrails as rules within the Data Loss Prevention policy. They inspect prompts, responses and files embedded in prompts exchanged between users and AI applications, and they apply guardrail classifications: security guardrails that detect attacks such as prompt injection, privacy guardrails that detect personal and sensitive data, and safety guardrails for harmful content. Combined with data classifications for items such as source code and customer records, a guardrail rule can block a prompt carrying sensitive data while ordinary use of the AI tool continues, which matches the requirement to keep the tools available. A content category block on generative AI applications removes the risk by removing the service, contradicting the stated decision to keep allowing the tools. A SaaS API DLP rule depends on API access to a sanctioned tenant the company controls and scans stored content after the fact; it cannot stop a prompt as it is sent to a public AI service. Investigate risk scores describe how risky a domain is; they do not inspect prompt content, and a low risk score never means sensitive data is safe to send. Exam caveat: as with other inline DLP, guardrails need visibility into the traffic, so decryption must apply to the AI applications in scope. Operational check: send a test prompt containing a sample sensitive record to an approved AI tool and confirm the guardrail event and block in the DLP log.