Topic starter
18/08/2026 2:28 pm
TL;DR: Prompt-side disclosure is already putting confidential data into public AI tools, Seclore says, with 68% of employees not following policy and one in twelve prompts containing confidential information. Prompt governance needs masking, logging, and tighter blocking before sensitive values reach the model.
Editorial analysis by NHI Mgmt Group, based on content published by Seclore: “The Debate About AI in the Enterprise Is Over. Here Is the Only Question That Matters.”.
By the numbers:
- 68 percent of enterprise employees are not following policy on sharing sensitive data with external AI tools, according to Seclore.
Key questions
Q: Why do conventional DLP controls miss AI prompt leakage?
A: Because they were built for fixed endpoints and predictable paths such as email, storage, and uploads.
Q: How can security teams tell whether AI lifecycle controls are working?
A: They should look for evidence that access requests, policy enforcement, and usage visibility are centrally recorded and current.
Q: How should organisations govern access to data used by AI systems?
A: Treat AI data access as an identity governance problem, not just a data storage problem.
Practitioner guidance
- Implement context-window policy enforcement Classify sensitive values before they enter prompts, retrieval queries, or agent workflows, and apply policy at the interaction layer rather than only at the email or file boundary.
- Deploy tokenisation for approved AI use Replace regulated or confidential values with structure-preserving tokens so users can keep working without exposing the original data to the model.
- Log AI interactions for audit and review Capture who sent the request, what data classes were involved, which policy fired, and which model received the input so governance teams can reconstruct usage later.
Bottom line: The enterprise AI risk is no longer abstract, because sensitive data can enter public models through ordinary work tasks and agent workflows.
Glossary terms: Context Window, Tokenisation, AI Data Governance, Prompt-Side Data Exposure
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
18/08/2026 3:16 pm
Context-window governance is becoming the new AI control plane. The article is right to frame the model input layer as the place where risk is decided, because that is where data either remains governed or becomes consumable by an external model. For identity and access teams, this shifts attention from only who can use AI to what data those users, applications, and agents are allowed to place into it. Practitioners should treat the context window as a policy enforcement boundary.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between masking and blocking in AI governance?
A: Masking substitutes sensitive values with safe tokens so the model can still process the request, while blocking stops the request entirely. Masking supports productive use of AI with confidential data, whereas blocking is reserved for cases where the data should never reach the model.
👉 Read our full editorial: AI context-window security is now the enterprise control point