# INP-04 Sensitive content handling

Domain: INP Input & Prompt Security · HI-AAF v1.3 · Public review · https://humanintel.net/standard/inp/inp-04

PII and other sensitive content in inputs is detected and handled per policy (redact, block, or log).

Personally identifiable information and other sensitive content in inputs is detected at the input layer and handled per the organization's data classification policy: redacted, blocked, or logged depending on the context and the agent's authorization level. This control works in concert with DAT-06 and DAT-07 to ensure sensitive data does not propagate where it should not.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for INP-04: Detection is applied to all input paths; handling rules are documented per data class; detection accuracy is measured; false negatives are tracked and the detection pipeline is tuned.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- Detection is applied to all input paths.
- Handling rules are documented per data class.
- Detection accuracy is measured.
- False negatives are tracked and the detection pipeline is tuned.

## Framework mappings

- NIST AI RMF: MEASURE 2.8
- ISO/IEC 42001: A.7.2
- OWASP LLM Top 10: LLM03
- SOC 2 (TSC): CC7.1
- EU AI Act: Art. 15(4)
- Singapore: MAIGF Security, AI Verify Security

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Related

- Cites DAT-06 Training and RAG data provenance: https://humanintel.net/standard/dat/dat-06
- Cites DAT-07 Data residency requirements: https://humanintel.net/standard/dat/dat-07

## Cite this control

Human Intelligence. HI-AAF v1.3, INP-04 Sensitive content handling. Public review edition, July 2026. https://humanintel.net/standard/inp/inp-04