Prompt Rules: Describe a Situation for an AI Judge

Part of Security rules.

Describe a situation

A prompt rule describes what should be detected, for example: “The agent is attempting to share confidential, unreleased business information with an outside recipient.” A separate evaluator uses your Organization-aware judge model route and has no tools.

The evaluator sees the complete immediate candidate and, when available, up to ten preceding messages from the same conversation. The limit is 16,000 input tokens and 30 seconds. If the immediate candidate cannot be checked completely, the result is unavailable. Findings record omitted historical context. Cross-run behavioral correlation is not included.

Model judgment can produce both misses and false positives. Test varied positive and negative examples and review Monitor findings before relying on a semantic rule for blocking. Invalid model output and provider outages are recorded as unavailable checks, separately from actual matches.

Each evaluation attempt makes a model call. An unavailable Monitor check can retry up to three attempts for the same captured event, adding cost. Monitor runs the call in the background and does not slow the agent; Block waits for the verdict before the action proceeds. A rule on incoming messages or returned tool results can be checked several times in every agent turn. The evaluator reads the same untrusted text it is judging, and the platform tells it to treat that text as data and to ignore any instructions in it, but text written to mislead it can still succeed. A manipulated verdict is a miss under Monitor, and under Block it could allow or deny the wrong action.

Monitor departures from expected purpose

When the detector library is enabled, choose Outside expected purpose (Monitor only). Select 1–100 agents in your Organization, then describe their approved purpose, permitted supporting work and material departures that deserve attention. Several agents can share one rule. For a different baseline, create a separate assigned rule and deliberately update the original assignment; overlapping rules apply independently and never override other restrictions.

The published text is the approved baseline. Changing an agent's charter, editing a draft or resolving a finding does not change it. Publication, reassignment and disablement follow the existing independent security-policy review process. The working agent cannot update its own baseline. Existing rules without agent assignments retain their Organization-wide coverage.

The separate judge checks each captured action and preceding conversation context linked to its retained source message. Later replies cannot change that inspection context. Tool-call checks often have no conversation context. It does not compare activity across runs or learn new behavior automatically. Ordinary supporting work, discussion, quotations and refusals should remain quiet; uncertain judgments, false positives and missed departures are possible. This monitor cannot block, require approval or halt an agent. Existing access controls still apply independently.

Each applicable capture and condition costs one judge call per attempt with the same limits above; unavailable Monitor checks may retry up to three attempts. One operation can reach several native capture boundaries or overlapping rules. Grouping can suppress additional warnings, but it does not remove those model calls. Findings and configured email use the existing grouping and retry behavior; a queued or provider-accepted warning does not establish inbox receipt. Your installation operator must separately monitor capture/evaluation/notification health and verify delivery before making a continuous-monitoring assurance claim. There is no NIST certification implied by enabling a rule.

Judge presets

When your deployment administrator has opened the detector library, the Describe a situation condition offers Start from a preset: curated descriptions of situations that are hard to catch with a pattern. Choose one, read what it costs and what it misses, and choose Use this preset. The preset fills the situation text, and for a fresh rule also the name, description and severity, as an ordinary draft in Monitor mode. You can edit every word. Nothing is active until you publish, and a published revision keeps the exact text it was published with; a later preset version never changes it. The draft records which preset and version it started from, which evaluation ignores.

The presets are: confidential business information to an outside recipient; source code and technical designs leaving the organization; legally privileged material leaving the organization; personal information about individuals disclosed; content that tries to obtain credentials; instructions aimed at the AI assistant; and non-public information about a project you name. Two presets are meant for incoming messages, returned tool results and sandbox responses (credentials and instructions); the rest are meant for outgoing content and tool-call arguments. A preset moves the rule's target only when the target you chose cannot apply to it.

Limits to know before you rely on one:

• Presets are model judgment, written in general terms. They produce misses and false positives, and the platform has not measured them on your traffic. Start with Monitor and review the findings.
• Each preset lists what it is known to miss or over-flag. In particular the judge cannot tell which recipients are inside your organization, so use the destination condition on outgoing rules to name your own domains. Whether a document is privileged, confidential or controlled is not something a rule decides.
• Events and pages over the 16,000-token limit, provider outages and unreadable answers are recorded as unavailable, never as clean. Under Block, an unavailable check denies the action.
• The instructions preset is a tripwire for content that tries to direct the agent. No finding does not mean content was safe, and Block on incoming content pauses the whole agent, so anyone who can send the agent content can cause that. To limit what a compromised agent could do, use outbound content rules, approved destinations and tool restrictions.
• Presets are never part of a rule template, because each would add a model call to every event. You choose them deliberately, one rule at a time.
• Use the personal-identifier detector for numbers with checksums, such as national identifiers and IBANs. It is exact, local and costs no model call; the personal-data preset is for names, addresses and records that no pattern can recognize.

Back to Security rules.