# What is Data Leakage Prevention?

Also called DLP, Data Loss Prevention.

Data leakage prevention is the practice of stopping sensitive information from leaving a controlled environment through unintended channels. In AI systems the channels include prompts sent to external providers, model outputs delivered to the wrong recipient, over-permissioned retrieval, logs and telemetry, and training on data that was never cleared for that purpose.

Traditional DLP inspects email, file transfers, and endpoints for classified content. AI systems add channels that classic tooling does not watch. Every prompt is an outbound transfer of whatever text it contains. Every retrieval step can pull a record the requester was never entitled to see. Every debug log can persist a payload that the application layer would have redacted.

The most common failure is over-permissioned retrieval. A vector index or search layer built without per-record access control will happily return a document to any user whose question matches it, because relevance ranking has no concept of entitlement. Enforcing the requesting principal's permissions at query time, rather than filtering afterward, is the structural fix.

Training and retention deserve separate treatment. Whether a provider trains on submitted data is a contractual matter, usually settled in the service terms and the data processing agreement rather than in code. Retention windows for prompts, completions, and traces determine how long a leak remains recoverable, and shorter windows reduce the blast radius of any later compromise.

Effective programs combine classification with placement. Sensitive categories are defined first, then controls are placed on each channel: detection and redaction before text leaves the boundary, entitlement checks inside retrieval, scrubbing in logging middleware, and egress rules on outbound integrations. Detection alone, without a decision about what to do on a hit, produces alerts rather than prevention.

## Key points

- AI adds channels classic DLP tooling does not watch
- Prompts to external providers are outbound data transfers
- Over-permissioned retrieval is the most common leak path
- Logs and traces persist payloads the app already redacted
- Classify first, then place a control on each channel

## In practice

An internal assistant indexes a shared drive that includes a folder of compensation letters. The index is built with a single service account, so relevance alone decides what is returned. An ordinary employee asks a general question about salary bands and receives a passage from a named colleague's letter. Enforcing the asker's own file permissions at query time would have excluded the document before ranking.

## Related terms

- [PII Detection](/en/glossary/pii-detection)
- [PII Redaction](/en/glossary/pii-redaction)
- [Tenant Isolation](/en/glossary/tenant-isolation)
- [Least Privilege](/en/glossary/least-privilege)
- [Data Residency](/en/glossary/data-residency)

[Back to the AI Glossary](/en/glossary)