POL-004 · All models

No customer data sent to public LLM

Compiled into the runtime gateway and evaluated inline on every prompt, tool call and completion in scope. Owned by CISO.

Simulate this policycriticalenforcingEdit in rule builder

Triggers / 30d

91

blocks, masks and escalations

Integrations bound

4

enforced at each connection

Severity

critical

owner CISO

Added latency

7 ms

p99 within the 60 ms budget

Rule definition

Compiled expression

When

  • endpoint not in sanctioned registry

Then

  • block
  • revoke session token

Policy as code

apiVersion: truint.ai/v1
kind: RuntimePolicy
metadata:
  id: POL-004
  name: "No customer data sent to public LLM"
  owner: "CISO"
  scope: "All models"
spec:
  severity: critical
  mode: enforce
  when:
    - "endpoint not in sanctioned registry"
  then:
    - "block"
    - "revoke session token"

Governance metadata

Policy ID
POL-004
Owner
CISO
Scope
All models
State
Enforcing inline
Catalog version
2026.07.3
Last change
2026-07-22 · approved by AI Council

Bound integrations

Where this rule executes

Azure OpenAI · gpt-4.1INT-LLM-01 · Microsoft AzureBedrock · claude-sonnetINT-LLM-02 · AWSVertex · gemini-2.5INT-LLM-03 · Google CloudOpenAI public APIINT-LLM-05 · OpenAI

Recent evaluations

Decisions where this rule fired

11:37:42Loan Approval Agent· emp-20160escalate

Summarise this applicant's bureau file and recommend a limit.

11:37:07Loan Approval Agent· emp-20725escalate

Summarise this applicant's bureau file and recommend a limit.