Prompt-surface control gap

Expanded Definition

A prompt-surface control gap describes a governance and technical blind spot in AI security: organisations can observe that prompts were submitted, reviewed, or logged, but still cannot intervene at the moment a user or agent is composing the prompt. In practice, the missing layer sits at the prompt surface itself, usually the browser, desktop, extension, or endpoint where text is assembled before it reaches an LLM, workflow, or AI agent. That distinction matters because post-event visibility is not the same as preventive control. A log can prove an unsafe prompt existed, but it cannot stop secrets, regulated data, or unsafe instructions from being sent in the first place. This is especially relevant where AI access is embedded in ordinary business applications and where users may not realise that the prompt contains sensitive context. The closest governance analogue is preventive control design in NIST SP 800-53 Rev 5 Security and Privacy Controls, but no single standard yet names this exact gap. The most common misapplication is treating audit logging as prompt control, which occurs when organisations assume visibility alone prevents unsafe submission.

Examples and Use Cases

Implementing prompt-surface control rigorously often introduces user experience friction, requiring organisations to weigh stronger prevention against workflow speed and adoption.

• A financial services team monitors prompts sent to an internal LLM, but employees can still paste account data into the prompt box because no endpoint policy blocks it before submission.
• A software engineering group uses SIEM alerts to review AI activity after the fact, yet there is no browser-layer enforcement to stop source code or credentials from entering an external AI tool.
• An NHI-heavy environment allows an AI agent to draft messages using connected tools, but there is no control at the point where the agent constructs the prompt from tokens, secrets, or retrieved context.
• A regulated support desk records prompt histories for audit, but staff can still request prohibited actions because the only control is retrospective review rather than live gating.
• A security team deploys OWASP guidance for LLM application risks to classify prompt injection and data leakage patterns, then maps that understanding to a prompt-time enforcement layer instead of relying on logs alone.

Why It Matters for Security Teams

Prompt-surface control gaps matter because they undermine the practical value of AI governance. If the organisation cannot influence what is submitted, then policy becomes observational rather than preventive. That creates exposure to prompt injection, accidental disclosure of secrets, unsafe instructions to AI agents, and unmanaged data transfer into external services. For teams responsible for identity and access, the issue is not only content risk but also authority risk: an AI agent with tool access can turn a weak prompt into an action with real operational impact. This is why prompt-surface controls connect naturally to browser policy, endpoint management, DLP, and non-human identity governance. The control objective is to move enforcement closer to the point of intent, before the request leaves the user or agent environment. For broader cyber governance, the principle aligns with preventive controls in NIST Cybersecurity Framework 2.0 and with AI risk management expectations in NIST AI Risk Management Framework. Organisations typically encounter the impact only after a sensitive prompt has already been sent or an AI agent has already acted, at which point prompt-surface control becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• What is the difference between prompt-based control and runtime authorization for agents?
• When should organisations treat credential rotation as an attack surface control?
• What breaks when prompt instructions are used as a security control?
• What is the difference between prompt injection and traditional access control failures?