Skip to main content

Policy Categories

Containment.AI organizes policies into categories for easier management. Each category addresses a specific area of AI governance, and the category you choose determines which detection editor the policy uses (see Configuring Policies).

The Default noted under each category below is the typical enforcement action for policies of that kind, not a category-level setting — every policy carries its own action.

Data Loss Prevention​

Policies that prevent sensitive organizational data from being shared with AI platforms.

  • Detects confidential documents, internal reports, and proprietary data
  • Blocks sharing of classified or restricted content
  • Monitors for bulk data extraction patterns
  • Default: Block

PII Detection​

Policies that detect personally identifiable information.

  • Social Security Numbers (XXX-XX-XXXX pattern matching — pattern only, no further validation; an SSN carries no check digit, so there is nothing to checksum)
  • Credit card numbers (Visa, Mastercard, Amex with Luhn validation)
  • Phone numbers (US and international formats)
  • Email addresses
  • Physical addresses
  • Dates of birth
  • Default: Block for high-sensitivity PII, Detect for lower-sensitivity

Prompt Injection​

Policies that detect and prevent prompt injection attacks against AI systems.

  • Identifies attempts to override system prompts
  • Detects jailbreak-adjacent injection patterns
  • Monitors for encoded or obfuscated injection attempts
  • Default: Block

Jailbreak Detection​

Policies that detect attempts to bypass AI safety measures.

  • Identifies known jailbreak patterns and techniques
  • Detects role-play based bypass attempts
  • Monitors for evolving jailbreak methodologies
  • Default: Block

Toxicity & Content​

Policies that detect toxic, harmful, or inappropriate content.

  • Identifies hate speech and discriminatory language
  • Detects threats and violent content
  • Monitors for harassment patterns
  • Default: Detect

Compliance​

Policies designed to map to specific regulatory frameworks. These categories help you map detection coverage to your own obligations; Containment.AI does not itself hold a certification for any of these frameworks.

  • HIPAA - Protected health information
  • GDPR - Personal data protection
  • PCI DSS - Payment card data
  • Default: Varies by regulation

SQL Injection​

Policies that detect SQL injection patterns in AI interactions.

  • Identifies SQL query fragments in prompts
  • Detects common injection patterns
  • Prevents leaking of database structures
  • Default: Block

XSS Prevention​

Policies that detect cross-site scripting patterns.

  • Identifies script injection in AI-generated content
  • Detects HTML/JavaScript injection patterns
  • Monitors for encoded XSS payloads
  • Default: Block

URL Filtering​

Policies that control URLs shared with or generated by AI.

  • Blocks known malicious URLs
  • Detects phishing URL patterns
  • Monitors for internal URL leakage
  • Default: Detect

Code Detection​

Policies protecting proprietary code and intellectual property.

  • Detects source code snippets (function definitions, class structures)
  • Identifies internal documentation markers ("Confidential", "Internal only")
  • Monitors for repository paths and project identifiers
  • Default: Detect

Content Moderation​

Policies for general content quality and appropriateness.

  • Ensures AI-generated content meets organizational standards
  • Detects inappropriate or off-topic usage
  • Monitors content for brand safety
  • Default: Detect

Formatting​

Policies that enforce output formatting standards.

  • Validates AI response formatting
  • Ensures consistent output structure
  • Monitors for formatting anomalies
  • Default: Detect

Copyright & Licensing​

Policies that detect copyrighted or licensed content.

  • Identifies copyrighted text passages
  • Detects licensed code snippets
  • Monitors for trademark usage
  • Default: Detect

Budget Governance​

Policies that monitor and control AI spending.

  • Tracks token usage against budgets
  • Alerts on unusual spending patterns
  • Enforces per-user or per-team limits
  • Default: Detect

Behavioral Analytics​

Policies that analyze request-rate patterns.

  • Flags anomalous request rates from a single actor
  • Configurable per-minute and per-hour thresholds
  • Default: Detect
note

Rate-anomaly policies are authored in the dashboard but evaluated by the policy-check service rather than in the browser, so they do not participate in the extension's local fallback path.

Shadow AI​

Policies that surface unsanctioned AI tool usage.

  • Flags AI surfaces appearing in your organization for the first time
  • Supports discovery of tools outside your approved set
  • Default: Detect

PHI Protection​

Policies focused specifically on protected health information.

  • Detects medical identifiers and clinical detail in prompts
  • Complements the broader Compliance category
  • Default: Block

Bias & Fairness​

Policies that flag content raising bias or fairness concerns.

  • Identifies prompts and responses that may encode unfair treatment
  • Supports responsible-AI review workflows
  • Default: Detect

AI Code Security​

Policies covering security risks specific to AI-assisted code.

  • Flags insecure patterns in AI-generated or AI-bound code
  • Complements the Code Detection category
  • Default: Detect

Custom​

Professional

Professional and Enterprise plans can create custom policies:

Creating Custom Policies​

  1. Go to Policies
  2. Click Create custom policy (or Create from description to describe the rule in plain language)
  3. Work through the three steps: Basic info, Detection rules, Action & scope
  4. Save and enable

Alternatively, click Use template to start from one of the built-in templates.

See Configuring Policies for what each step contains.

Category Settings​

note

Categories organize and group policies; they do not carry their own settings. There is no per-category bulk enable/disable, no category default enforcement action or severity, and no category export — enforcement action, severity, and scope are set on each individual policy.