Guard events
Overview
Section titled “Overview”Detect & respond → Detections → Guard events (/compliance/data-protection) opens the Data protection report. It lists every decision a Shield360 guard made about sensitive data on its way to an AI model, for the current project and environment. The data might be a payment card in a ChatGPT prompt, a secret a coding agent was about to send, or a customer’s details in an application’s prompt.
Guard decisions come from four sources:
| Source | Where the guard runs |
|---|---|
| Coding agents | The Shield360 coding-agent hooks |
| Apps (SDK) | Your own applications, through the Shield360 SDK guard or the guard check API |
| Browser extension | The Shield360 browser extension, on AI sites |
| AI proxy | The Shield360 AI proxy |
Each event has one outcome:
| Outcome | Meaning |
|---|---|
| Blocked | Never sent |
| Redacted | Sent with the sensitive data removed |
| Warned | Sent, and recorded |
| Sent anyway | Warned, then sent anyway with a reason given by the person |
| Allowed | Allowed, and recorded |
What a guard does with each kind of data is set in the enforcement policy.
Who can see it
Section titled “Who can see it”| Permission | Allows | Held by |
|---|---|---|
compliance.dataprotection.view (View data protection events) | The report and each event’s details | Owners, administrators, compliance officers, analysts, the Security role and viewers |
compliance.dataprotection.export (Export data protection evidence) | Download events as CSV | Owners, administrators and compliance officers |
Opening the report, opening an event and exporting are all recorded in the audit log as data access. Guard events are part of the Security module.
Review guard events
Section titled “Review guard events”The report covers the project and environment selected in the header. Set the time range with the filter at the top right.
The tiles count Events, Blocked, Redacted, Warned and Sent anyway, and the People and Computers and apps involved. Over time charts the outcomes across the range. Kinds of data, People and Tools and apps list the most frequent ones.
Choose from Outcomes and Sources. Select a kind of data, a person or a tool in the side panels, or a kind or tool in the table, to filter by it. Each filter appears as a chip. Select a chip to remove it.
The Events table shows When, Outcome, Data found, Where (the tool or app, its source and target, and the tool call), Person and Computer. Select a person or computer to open their activity page, or select the row for the event’s details.
The table shows the latest 200 events. The export has every event that matches.
An event’s details
Section titled “An event’s details”The details panel shows what was stopped, where, and how often the same values have turned up:
- What happened: the outcome, when, where (tool or app, source and target), what was checked, person, computer, environment, model, session, guard and event ID. Where they apply, it also shows the Policy version that was in force and the Reason given for sending.
- Values found: each value’s type and masked form, and the vault secret it matched, if any. It also shows how often the same value has been seen across all time: how many times, how many were blocked, by how many people on how many machines, and when first and last. Show every event with this value filters the report by that value’s fingerprint.
- Same session: the session’s other events.
- The person’s other events (90 days).
A link to an event opens with its details showing, for example from an alert (/compliance/data-protection?event=<id>).
Export evidence
Section titled “Export evidence”Select Export evidence (CSV) to download every event that matches the current range and filters as shield360-data-protection_<from>_<to>.csv, up to 100,000 events. The columns are Event ID, Occurred (UTC), Outcome, Source, Tool or app, What was checked, Kinds of data, Tool call, Person, Computer, Environment, Session, Model, Guard, File or command, Values found (type and fingerprint), Fingerprints, Policy version and Reason for sending anyway.
Guard events elsewhere
Section titled “Guard events elsewhere”- The same decisions appear with every other kind of violation in Policies → Violations. The link Also in Policies → Violations at the top of the page opens them there. See Violations.
- Sensitive data found by scanning stored content, rather than stopped on the way to a model, is under Sensitive data.
- Live traffic shows guard violations next to the agent or computer they came from.