AI Data Leakage Prevention: How to Stop Sensitive Data From Reaching AI Tools and Enforce AI Usage Policy

Employees use personal AI tools when the company tools are slower to get

Employees use personal AI tools when the company offers nothing, or when the company tool takes weeks to get access to. The fix has three parts, and the gateway is only one of them:

Skip the approved-tools part, and people keep using personal tools. Tetrate’s post on keeping marketers away from Fable shows how to route a desktop AI app through the gateway. Non-developers then have an approved tool too.

How AI guardrails prevent data leakage: each request is checked inline, then redacted or blocked

In Tetrate Agent Router Enterprise, guardrails run inside the Envoy proxy as a dynamic module. The guardrails architecture page describes five stages. The module stops the request, checks each rule, applies the action, checks the response before it returns, and records the decision. A blocked prompt never reaches the provider, so the provider never sees the content and never bills for the request.

Each rule has a check type, a provider that runs the check, an action, and a mode:

The guardrails reference lists all 23 check types and 14 templates, including Baseline PII Protection, GDPR EU PII Protection, Singapore PDPA, and Healthcare Claims. Templates default to redact and monitor.

Start with PII and secrets on the input stage

The guide to detecting and redacting sensitive data covers the first rules to create. The pii check covers names, emails, phone numbers, national IDs, payment cards, and IBANs. The secrets check covers AWS, GitHub, and Slack credentials, generic API keys, and tokens. The regexp check handles formats specific to your organization, such as internal ticket IDs or account numbers. A shared pattern list has more than 80 built-in patterns.

Latency depends on the provider. The regexp and builtin providers add close to zero milliseconds and make no network call. The tetrate provider runs ML classifiers on your own cluster and adds 40 to 120 ms. Azure AI Content Safety adds about 200 ms and sends content to Microsoft. Run fast checks first, so a match ends the evaluation before the slow check runs.

Coding assistants need their own project and a secrets rule

Claude Code, GitHub Copilot, Cursor, Continue, and Cline send source code and configuration files to models. Source code contains credentials more often than chat prompts do. The guide to protecting coding assistant traffic recommends a separate project per tool, with per-tool API keys. Then add a guardrail with the secrets check on the input stage. Guardrails are scoped to a project, so separation comes from which project a key belongs to. GitHub Copilot chat and agent mode in VS Code reach the gateway through the Tetrate VS Code extension. The same secrets rule then catches credentials in Copilot prompts before the prompts leave the machine. Inline Copilot completions stay on GitHub’s servers and are outside the gateway.

Azure AI Foundry agents that send traffic through the gateway keep Microsoft’s content filters and safety systems on the Foundry side. The customer owns those filters. Gateway guardrails add PII and secrets checks on the same requests.

Prompt injection detection is not exact, so start in monitor mode

The prompt_injection and jailbreak checks catch instructions hidden in retrieved documents or tool outputs that try to make the model ignore the system prompt. The prompt injection guide states the limit. Detection uses patterns and likelihood scores. Harmless content that looks like an attack causes false positives. New phrasing is sometimes not detected. Run the rule in monitor mode first and adjust the sensitivity before switching to enforce.

Audit logs and SIEM export prove AI usage policy enforcement to an auditor

An auditor needs a record of each decision. Agent Router Enterprise records two streams:

1. The audit log captures every administrative change: for example, who created a key or changed a guardrail. Entries cannot be edited or deleted by any user.
2. Policy decisions carry one of four outcomes (Allow, Deny, Modify, Redact) with a correlation ID, the caller identity, the model, and the policy version. Both streams export to a SIEM such as Splunk, Datadog, or Amazon S3.

The request log settings offer three modes: Full, Metadata only, and Off. Metadata only keeps token counts and cost and drops the bodies. Metadata only is the common choice for regulated data.

Identity comes from SSO, so policy attaches to real people

Agent Router Enterprise signs in through OIDC only. There is no local password database. Entra ID, Okta, Google Workspace, Auth0, Keycloak, and Ping are documented. Group claims from the identity provider map to roles, teams, and budgets. A policy for the Finance group then applies to whoever is listed in Finance in the directory.

AI data leakage prevention at the gateway has five limits

1. Personal devices, personal accounts, and applications that hardcode a provider SDK with no base URL override are outside the gateway.
2. MCP traffic is not inspected by content guardrails. Guardrails run on LLM requests only. If a tool result is placed inside an LLM request, the guardrails check that LLM request, including the tool result, as tool content.
3. An organization-wide rule means creating the rule in each project, because guardrails are project-scoped.
4. ML-based checks produce some false positives.
5. OpenTelemetry collectors subscribed to the request log signal receive full records in every request log mode.

Frequently asked questions

Can an AI gateway stop employees from using ChatGPT on personal accounts? No. A gateway governs traffic that passes through the gateway. Stopping personal accounts requires network or endpoint controls, and approved tools good enough that people choose them.

What is an AI guardrail? A guardrail is a rule that inspects a request or response at the gateway. The rule checks for a type of content such as PII or secrets. The rule then redacts the content, blocks the request, or records the match.

Does redaction send my data to a third party? Regex and built-in checks run inside your gateway with no network call. Tetrate’s ML classifiers run on your own cluster. Only Azure AI Content Safety and external guardrail services send content outside.

What is the difference between monitor mode and enforce mode? Monitor mode logs what the rule would have done and changes nothing. Enforce mode applies the redact or block action. Roll out every new rule in monitor mode first.

How do I prove to an auditor what the gateway blocked? Export policy decisions and the audit log to your SIEM. Each decision carries a correlation ID, the verdict, the policy version, and the caller identity.

Do guardrails cover MCP tool traffic? No. MCP traffic is not inspected by content guardrails. MCP requests are governed by server approval, tool selection, identity, and audit. Guardrails run on LLM requests only, and they check a tool result only when the result is placed inside an LLM request.

How much latency do AI guardrails add? Regex and built-in checks add close to zero milliseconds. Tetrate’s ML classifiers add 40 to 120 milliseconds. Azure AI Content Safety adds about 200 milliseconds.

Does a blocked prompt get billed by the provider? No. A blocked prompt never reaches the provider, so the provider never sees the content and never bills for the request.

Does the gateway store prompts and responses? That depends on the request log mode. Full mode stores prompt and response bodies. Metadata only keeps token counts and cost and drops the bodies. Off stores no request log.

Related reading

• AI Guardrails product page
• AI Governance solution page
• AI Governance Framework in the Learning Center
• Agent Security: What NIST Wants You to Think About Before Your Agent Calls a Tool
• Guardrails best practices and FAQ in the docs
• About guardrails in the docs