Prompt Vault surface audit
This page tracks where raw prompt text can move after ingestion and how Prompt Vault keeps protected modes from exposing it through normal evidence flows.
This page tracks where raw prompt text can move after ingestion and how Prompt Vault keeps protected modes from exposing it through normal evidence flows.
Audit result
Prompt Vault has two privacy boundaries:
- Retention boundary: Runtime Shield and OTLP apply the selected mode before normal rows are stored.
- Surface boundary: Normal JSON, copy, export, preview, and AI-analysis paths re-apply Prompt Vault-safe serialization before rendering or sending retained payloads.
In Sealed Evidence and Promptless, prompt-like fields are replaced with Prompt Vault placeholders in normal surfaces. The governed reveal endpoint remains the only dashboard path that returns sealed prompt text.
Covered surfaces
| Surface | Normal data source | Protected-mode behavior |
|---|---|---|
| Activity feed | activity_feed_page_v2 payloads | Server responses are serialized with Prompt Vault-safe JSON before the table or drawer receives them. |
| Activity drawer Raw JSON and Export JSON | selected Activity event payload | Copy/download uses Prompt Vault-safe JSON. Start-rule evidence handoff also receives the safe payload. |
| Workstation event cards | shield_events.context | Prompt evidence renders as sealed/not retained, and raw context blocks use safe JSON. |
| Shield event cards | shield_events.context | Metadata and raw context blocks use safe JSON. |
| Session timeline | getSessionEvents | Shield and OTLP event contexts are safe before client rendering. |
| Prompts & Decisions | OTLP prompt groups | Route returns safe OTLP events before grouping them for the UI. |
| Findings | finding prompt metadata | Sealed prompts use reveal controls; Promptless has no body to render. |
| Investigation timeline and evidence | alert detail, linked shield events, linked OTLP events | Alert detail normalizes linked evidence through safe JSON before it reaches the client. |
| Member timeline | shield context | Raw context blocks use safe JSON. |
| Gateway context blocks | MCP context | Safe JSON is applied when Prompt Vault metadata exists. Arbitrary MCP prompt-like parameters need product classification before they become Prompt Vault-governed. |
| Custom detector preview and dry run | background Activity/OTLP samples | Sample candidates are safe before detector evaluation sees retained context. |
| Session JSON export | shield_events plus triage/output | Exported event context is safe and includes Prompt Vault metadata instead of protected prompt bodies. |
| Event archive | retained shield_events, events, otlp_events rows | Archived JSONL rows use safe JSON for protected Prompt Vault modes. |
| AI session analysis and LLM threat review | shield_events summaries | Event summaries are built from safe event data. |
| Notifications and exception AI triage | redacted evidence packs | Existing redaction removes raw prompt/tool fields before outbound notification or AI triage payloads. |
What still requires product classification
Prompt Vault currently protects supported prompt-submit events and OTLP prompt fields. Some tools use fields named prompt, message, content, or input as ordinary tool parameters. Those are not automatically treated as raw user prompts unless the event is already marked with Prompt Vault metadata.
The follow-up decision is whether to extend Prompt Vault from prompt events to arbitrary prompt-like tool parameters across MCP Gateway, browser extension events, gateway runtimes, and future connectors.
Verification expectation
Regression tests use canary prompt strings and fail if protected prompt text appears in safe JSON. Sandbox promotion should verify lint, tests, container build, ECR publish, Helm rollout, health checks, policy canary, RLS audit, and optional E2E smoke before production promotion.