Overview of content policies

A Sensitive Data Protection content policy is a reusable resource that you can use to evaluate content and determine whether to allow or block it based on its sensitivity. You can use content policies to integrate real-time data protection checks directly into your workflows.

In contrast to other Sensitive Data Protection inspection operations, such as a content.inspect call or an inspection job, a content policy doesn't return a list of findings. Instead, a content policy returns a single ALLOW or BLOCK verdict. The client application can then act on the verdict by allowing or blocking the content.

To create and manage content policies, see Create and manage content policies.

Benefits and use cases

Content policies let you act immediately on inspection results by producing a verdict rather than a list of findings. Example use cases include the following:

  • Automatically block chatbot responses or file uploads that contain sensitive information, such as credit card numbers or personally identifiable information (PII).
  • Integrate Sensitive Data Protection content policies with Gemini Enterprise to prevent it from using content that contains sensitive data. For more information, see Protect sensitive data in sources.
  • Get immediate, synchronous verdicts on content to enforce organizational data policies.
  • Get a verdict on whether to allow certain types of data in an AI model training dataset.

Parts of a content policy

Each content policy includes the following:

  • Inspection configuration: Defines what sensitive data to scan for using built-in or custom infoType detectors.
  • List of policy rules: An ordered list of rules. Each rule specifies conditions and an action (verdict). Sensitive Data Protection evaluates the rules in order; the first matching rule determines the verdict (ALLOW or BLOCK).
  • Default actions: Actions to take if Sensitive Data Protection can't scan a file or if the content is successfully scanned but matches no rules.
  • Logging configuration: Optional. Configuration to record the outcomes of policy evaluations to external systems, such as a BigQuery table. For information about the schema of the exported logs, see ContentPolicyActionLog.

Limits

For information about the maximum file sizes that Sensitive Data Protection can scan, see Content policy limits. In your content policy configuration, you can specify the verdict that Sensitive Data Protection assigns to files that are too large.

What's next