Most teams don't know every sensitive data type flowing through their prompts. Automatic policy setting solves that: the Gateway watches real traffic, works out what needs protecting, and proposes a policy — so you start protected instead of starting from a blank rulebook.
How it works
Observe
Point a project at Automatic mode. The Gateway samples prompts, responses, and uploaded documents and runs its full detector set against them — without forwarding anything unprotected; conservative defaults apply while it learns.
Detect & classify
It builds a live inventory of the sensitive types it actually sees — which PII, PHI, cardholder data, and secrets appear, how often, and in which fields.
Propose
From that inventory it drafts a policy: an action (redact, mask, or block) for each detected type, plus content rules for things like password-reset emails. Each proposal comes with the evidence that triggered it.
Approve
You review the proposed rules and accept, tune, or reject each one. Nothing changes your enforced policy until you approve it.
Adapt
As your data changes — a new document type, a new field with account numbers — the Gateway flags the drift and proposes an update, so coverage keeps pace without a manual audit.
What it configures for you
- Entity actions — a sensible redact/mask/block choice per detected type.
- Content rules — blocks for secrets, credentials, and reset/MFA emails.
- Framework alignment — if it detects PHI or PAN, it proposes the matching HIPAA or PCI posture.
- Confidence thresholds — how aggressive detection should be, tuned to your tolerance for false positives.
Guardrails
Safe by default while learning
During the observe phase the Gateway applies conservative built-in protection, so sensitive data is never forwarded in the clear just because a custom rule doesn't exist yet. Automatic mode only ever adds protection for review — it can't silently weaken it.
- Approval required — proposals never auto-enforce unless you explicitly enable auto-apply for low-risk additions.
- Explainable — every proposed rule links to the sample data that justified it.
- Reversible — accepted changes are versioned; roll back any time (see Policies).
When to use it
- New projects — get a strong baseline in hours instead of guessing.
- Unknown data — legacy inboxes, mixed document types, third-party feeds.
- Ongoing coverage — leave it on in advisory mode to catch new data types as they appear.
Tip
Pair Automatic mode with a short pilot: run it across a representative slice of traffic for a day or two, review the inventory it produces, then promote the proposed policy to your production projects.