POL-004 · All models

No customer data sent to public LLM

Compiled into the runtime gateway and evaluated inline on every prompt, tool call and completion in scope. Owned by CISO.

criticalenforcingEdit in rule builder

Triggers / 30d

blocks, masks and escalations

Integrations bound

enforced at each connection

Severity

critical

owner CISO

Added latency

7 ms

p99 within the 60 ms budget

Rule definition

Compiled expression

When

endpoint not in sanctioned registry

Then

block
revoke session token

Compiled rule

rule "POL-004" {
  scope    = "All models"
  severity = "critical"
  when {
    endpoint not in sanctioned registry
  }
  then {
    block
    revoke session token
  }
}

Governance metadata

Policy ID: POL-004
Owner: CISO
Scope: All models
State: Enforcing inline
Catalog version: 2026.07.3
Last change: 2026-07-22 · approved by AI Council

Bound integrations

Where this rule executes

Azure OpenAI · gpt-4.1INT-LLM-01 · Microsoft Azure Bedrock · claude-sonnetINT-LLM-02 · AWS Vertex · gemini-2.5INT-LLM-03 · Google Cloud OpenAI public APIINT-LLM-05 · OpenAI