DLP Policies for AI Traffic - Netskope Technical Documentation

You can define a DLP policy by configuring traffic matches on various criteria. You can create policy groups and add multiple policies to the group. A default policy group is present.

Create New DLP Policy Group

To create a new DLP policy group, follow the steps below.

Log in to the Netskope tenant UI and go to Policies > AI Gateway.
In the AI Gateway page, click the DLP tab and click New Policy Group.
In the New DLP Group page, enter a name for the group in the Group Name parameter.
Choose the position of the new policy group by selecting a group from the Before policy group or After policy group lists respectively.
Click Create.

Create New DLP Policy

To create a new access policy, follow the steps below.

Log in to the Netskope tenant UI and go to Policies > AI Gateway.
In the AI Gateway page, click the DLP tab and click New Policy.
In the New DLP Policy page, create a policy that matches one (or more) of the following criteria :
- Token Group
- AI Provider and Model
- Activity – Prompt, Response, Upload, and Download.
From the Add Exclusion Criteria Group list, choose the token group that you want to exclude from the match criteria. For example, you want to match against all openai AI Providers, but not for traffic with token group admin. In that case you can specify this exclusion criteria by selecting Add Exclusion Criteria Group, choose Token Group and select the required token group from the drop down.
Under Profile, select a DLP Profile from the list.
From the Action parameter, select the enforcement action to be applied when traffic matches your specified criteria:
- Monitor: Logs the traffic activity for visibility and allows the request to proceed to the subsequent policy.
- Block: Immediately terminates the connection and drops the traffic.
- Replace: Intercepts the response and replaces the content with a custom, administrator-defined message.
Specify the name of the policy, description, the policy group that it should be part of, and the position of the policy within that policy group.
Click Save and apply changes to your creation.

Create New DLP Policy Group

To create a new DLP policy group, follow the steps below.

In the AI Gateway page, click the DLP tab and click New Policy Group.

In the New DLP Group page, enter a name for the group in the Group Name parameter.

Choose the position of the new policy group by selecting a group from the Before policy group or After policy group lists respectively.

Click Create.

Create New DLP Policy

To create a new access policy, follow the steps below.

In the AI Gateway page, click the DLP tab and click New Policy.

In the New DLP Policy page, create a policy that matches one (or more) of the following criteria :

Token Group
AI Provider and Model
Activity – Prompt, Response, Upload, and Download.

From the Add Exclusion Criteria Group list, choose the token group that you want to exclude from the match criteria. For example, you want to match against all openai AI Providers, but not for traffic with token group admin. In that case you can specify this exclusion criteria by selecting Add Exclusion Criteria Group, choose Token Group and select the required token group from the drop down.

Under Profile, select a DLP Profile from the list.

From the Action parameter, select the enforcement action to be applied when traffic matches your specified criteria:

Monitor: Logs the traffic activity for visibility and allows the request to proceed to the subsequent policy.
Block: Immediately terminates the connection and drops the traffic.
Replace: Intercepts the response and replaces the content with a custom, administrator-defined message.

Specify the name of the policy, description, the policy group that it should be part of, and the position of the policy within that policy group.

Click Save and apply changes to your creation.