---
title: "Data Classification: Why Fixed Access Tiers Beat Prompt Filters"
source: https://bitvaria.com/en/datenklassifizierung-trust-tiers-statt-prompt-scanner
---

24\. Sept. 2026 · [AI](https://bitvaria.com/en/category/ai/)  · 12 min read

# Data Classification: Why Fixed Access Tiers Beat Prompt Filters

An AI system that scans every prompt for sensitive content is betting on detection. A system that fixes access rights beforehand needs no detection at all. Why the difference matters for an AI data-path review.

![An AI system that scans every prompt for sensitive content is betting on detection. A system that fixes access rights beforehand needs no detection at all. Why the difference matters for an AI data-path review.](https://bitvaria.com/_astro/datenklassifizierung-trust-tiers-statt-prompt-scanner.C2SYI2gS.jpg)

On this page

1.  [Two paths, one question](#two-paths-one-question)
2.  [Why the bet is a bad one](#why-the-bet-is-a-bad-one)
3.  [The wristband at the entrance, not the doorman listening to every sentence](#the-wristband-at-the-entrance-not-the-doorman-listening-to-every-sentence)
4.  [For the technical depth: what a data-path review can prove](#for-the-technical-depth-what-a-data-path-review-can-prove)
5.  [Frequently Asked Questions](#frequently-asked-questions)
6.  [Sources](#sources)

> **Data classification instead of prompt filters.**
> 
> Data classification means every file and email gets a rating of its confidentiality, in Microsoft 365 as a sensitivity label. If the label carries encryption, it fixes who may read and extract the content. The access tier is then settled on the file before anyone writes a prompt. A prompt filter works the other way round: it first has to detect sensitive content on every new phrasing. Both mechanisms often sit in the same product. Only one of them can be checked with a yes or no.

In 2025, a research team tricked several commercial filters for prompt injection and jailbreaks. Their tools: simple character tricks and automated rephrasing. Targets included Microsoft’s Azure Prompt Shield and Meta’s Prompt Guard. Evasion success rate: up to 100 percent, depending on the system. That is not an outlier from one lab. No system on Lakera’s public PINT leaderboard gets through the test set without errors. That is the pattern for filters that have to judge free text in real time.

For a data-path review, that is not a footnote. The question “what stops Copilot from exposing confidential data?” has two very different answers. Which one applies depends on which mechanism you mean.

## Two paths, one question

Microsoft 365 Copilot itself runs both paths side by side. The first: sensitivity labels attached to a file or email. A label on its own only marks the classification. Only a label with encryption sets usage rights. Then Microsoft’s own documentation requires a user to hold the EXTRACT usage right, in addition to VIEW, before Copilot returns the content. Without EXTRACT, Copilot does not summarize the file and only references it with a link. Microsoft names exceptions. The main one: Copilot in Edge and in Windows can reference encrypted content from the active browser tab even without EXTRACT. That holds as long as no DLP rule in Edge applies. As a rule, that check does not ask what the prompt says. It asks who is allowed to read the file and take text out of it.

The second path: a data loss prevention policy for the “Microsoft 365 Copilot and Copilot Chat” location. The same location can also exclude files with specific labels from processing, which is the first path again. The detection variant is the “sensitive information types” condition: it scans the text a user types into the prompt for patterns like IBANs or national ID numbers. On a match, Copilot does not respond. According to Microsoft, this prompt block is still in preview, and it does not inspect uploaded files, only the typed text. That is real-time detection on freely written text, written by exactly the person the filter is supposed to check.

The two paths do not answer the same threat. The label with usage rights governs what Copilot exposes from the file estate: to whom, from which file. The prompt block governs what a user types into the prompt themselves, say a customer number from memory. No file label applies to that second case, because no file is involved. This post’s question is the first one: what stops Copilot from returning confidential content from the file estate?

Both paths exist in the same product, often in the same configuration. Only the first is a fixed rule. The second is a bet on a classifier’s detection quality.

## Why the bet is a bad one

There is no public measurement of Microsoft’s prompt block. There is one for the neighbouring class: filters meant to detect prompt injection and jailbreaks, which likewise judge free text in real time. Lakera runs PINT, a public leaderboard for exactly that. The test set: 4,314 cases, including real attacks but also benign sentences worded to resemble attacks, meant to catch false positives. The vendor’s own filter tops the list at 95.22 percent, measured in May 2025, on a test set the vendor assembled itself. Behind it: Azure Prompt Shield at 89.1 percent and Meta’s Prompt Guard 2 at 78.8 percent. Google’s Model Armor sits at 70.1 percent, the original Prompt Guard at 61.8. Even the top score leaves almost five points open. Further down, ten to nearly forty are missing.

Those are scores under test conditions, not under active attack. The evasion study mentioned earlier shows what happens when someone deliberately tries to fool the filter. The most effective technique, text hidden inside emojis, reached 100 percent success according to the study, for prompt injections and jailbreaks alike.

Those numbers apply to injection filters, not to Microsoft’s sensitive information types. Those work differently: pattern-based, with regular expressions, keywords and checksums instead of a trained model. How often they miss in a prompt, nobody has measured publicly, in either direction. What both share is the approach. They judge text written by exactly the person trying to fool them, and they only find what matches their definition. No detector waiting on prompt text gets more reliable than the pattern it looks for. That is not a question of engineering. It is a question of approach.

## The wristband at the entrance, not the doorman listening to every sentence

A sensitivity label with encryption works like a wristband handed out at the entrance. Who may enter which area is fixed in advance. Nothing the person says later at the door changes that. A prompt filter works like a doorman who has to judge every sentence a guest says, live, to decide whether a phrasing sounds dangerous. The second job is structurally harder, because the number of possible sentences is unlimited, and the guest has every incentive to sound harmless.

This is where the picture ends. At the entrance, every guest gets a wristband. A file only gets its sensitivity label if someone assigns it. As a rule, a file without a label has only the protection of its sharing permissions. Whoever may open it also gets its content through Copilot, however confidential it is. The exception is encryption without a label, for instance through Rights Management. Then, according to Microsoft, Copilot checks VIEW and EXTRACT as well, only that protection is not inherited by new content. The extra layer the label adds does not exist for the unencrypted file. Classification is the precondition, not the outcome.

## For the technical depth: what a data-path review can prove

A review that documents data paths should therefore keep two categorically different questions apart. The first is provable. Which files carry which label, which of those labels bring encryption, who holds EXTRACT rights on them, and does that list match the intended permission structure? That can be checked against the configuration, with a clear yes or no per file. What that check does not show: whether the classification is right. A confidential file labelled as harmless looks correct in the configuration. And when labels are applied automatically, Microsoft says that happens through the same sensitive information types or trained classifiers. Their detection errors then end up in the label. Fixed enforcement does not remove them. It only makes the classification checkable, because it sits on the file as a label rather than in a classifier at runtime.

The second question is not provable, only estimable: how often does the DLP policy correctly catch sensitive content in a freely written prompt? Any number here is a snapshot against one specific test set, not a guarantee for the next sentence nobody has seen yet. Claims like “the filter prevents confidential data from leaking” are unsupportable without evidence for the concrete data path, no matter how well the filter scored on some benchmark.

In practice, that means DLP scanning of prompts is an extra net for the case where someone types sensitive details in themselves. For the question of what Copilot exposes from the file estate, it is not the foundation. The foundation is whether the data is classified at all, and whether the classification is right, before any AI tool ever sees it. An organization that pours effort into tuning detection rules but never systematically classified its file estate has swapped the easier task for the harder one.

You can now explain why a DLP alert on a Copilot prompt is not an access control. And you know which of the two questions a data-path review can answer with a yes or no. What follows from a documented permission structure once the provider managing it changes is the next question. See [What Happens When Your AI Vendor Disappears](https://bitvaria.com/en/was-passiert-wenn-der-dienstleister-wegfaellt).

## Frequently Asked Questions

**What does data classification mean for AI tools like Copilot?** Files and emails carry a sensitivity label that marks their confidentiality. A label can merely mark, or additionally bring encryption with usage rights. Only in the second case does Copilot check before output whether the user may extract the content. Without a label, the file’s ordinary sharing permissions apply; with encryption but no label, Copilot checks the usage rights set there.

**Why isn’t detecting sensitive data in a prompt a reliable safeguard?** Prompt filters have to judge free text in real time. There is no public measurement of Microsoft’s prompt block. For the neighbouring class of prompt injection filters, Lakera’s PINT leaderboard shows 95.22 percent even for the best system, and far less for weaker ones. Under deliberate evasion attempts, a 2025 study shows success rates of up to 100 percent against commercial systems.

**What is the difference between sensitivity labels and DLP policies for Copilot?** Sensitivity labels with encryption govern access through usage rights attached to the file. Copilot checks them before returning content from it. DLP policies for Copilot can scan the typed prompt text for sensitive patterns and block the response, or exclude files with specific labels from processing. Both can run in parallel, but they secure different cases. The label governs what Copilot exposes from the file estate, the prompt block governs what a user types in.

**Does a sensitivity-label structure replace checking the actual data paths?** No. A label only proves that a file has been classified. An access rule exists only once the label carries encryption with usage rights, or a policy reacts to the label. Whether the classification is right, how completely the data estate is classified, and which data paths an AI service actually uses, are further questions. All of them need to be checked.

## Sources

-   Sensitivity labels, EXTRACT and VIEW usage rights, existing permissions as the baseline protection even without a label; encryption without a label (Azure Rights Management) is likewise checked for VIEW and EXTRACT, without inheritance of the protection: [Microsoft Learn, Use Microsoft Purview to manage data security & compliance for Microsoft 365 Copilot](https://learn.microsoft.com/en-us/purview/ai-m365-copilot) (as of 2026-06-25).
-   Labels can classify without any protection settings; encryption with usage rights is a label configuration: [Microsoft Learn, Learn about sensitivity labels](https://learn.microsoft.com/en-us/purview/sensitivity-labels) (as of 2026-06-25).
-   Without EXTRACT no summary, only a link reference; exception for Copilot in Edge and Windows, which can reference encrypted content from the active browser tab without EXTRACT unless a DLP rule in Edge applies: [Microsoft Learn, Considerations for Microsoft Purview to manage Microsoft 365 Copilot](https://learn.microsoft.com/en-us/purview/ai-m365-copilot-considerations) (as of 2026-06-30).
-   DLP location “Microsoft 365 Copilot and Copilot Chat”: conditions sensitive information types (typed prompt text only, uploaded files not inspected, prompt block in preview) and sensitivity labels (exclusion from processing): [Microsoft Learn, Microsoft Purview DLP for Microsoft 365 Copilot and Copilot Chat](https://learn.microsoft.com/en-us/purview/dlp-microsoft365-copilot-location-learn-about) (as of 2026-09-17).
-   Sensitive information types as pattern-based classifiers (regular expressions, keywords, checksums, confidence levels): [Microsoft Learn, Learn about sensitive information types](https://learn.microsoft.com/en-us/purview/sit-sensitive-information-type-learn-about) (as of 2026-08-05).
-   Automatic labelling uses sensitive information types or trainable classifiers as its condition: [Microsoft Learn, Automatically apply a sensitivity label to Microsoft 365 data](https://learn.microsoft.com/en-us/purview/apply-sensitivity-label-automatically) (as of 2026-09-22).
-   PINT leaderboard, 4,314 test cases: Lakera Guard 95.22%, Azure AI Prompt Shield 89.1%, Llama Prompt Guard 2 78.8%, Llama Prompt Guard 61.8% (each May 2025), Google Model Armor 70.1% (2025-08-27); per Lakera, the Prompt Guard scores refer to jailbreak detection only: [GitHub, lakeraai/pint-benchmark](https://github.com/lakeraai/pint-benchmark).
-   Evasion of six detection systems, including Azure Prompt Shield and Meta Prompt Guard, via character injection and adversarial rephrasing, up to 100% success rate (emoji smuggling): Hackett, Birch, Trawicki, Suri, Garraghan, [Bypassing LLM Guardrails: An Empirical Analysis of Evasion Attacks against Prompt Injection and Jailbreak Detection Systems, arXiv:2504.11168](https://arxiv.org/abs/2504.11168), submitted 2025-04-15, revised 2025-07-14.

* * *

*Related: [Residency Is Not Jurisdiction](https://bitvaria.com/en/residenz-ist-nicht-jurisdiktion) and [Copilot: What the Admin Center Shows](https://bitvaria.com/en/was-das-admin-center-zeigt).*

-   [ki](https://bitvaria.com/en/tag/ki/)
-   [datenschutz](https://bitvaria.com/en/tag/datenschutz/)
-   [datenklassifizierung](https://bitvaria.com/en/tag/datenklassifizierung/)
-   [mittelstand](https://bitvaria.com/en/tag/mittelstand/)
-   [compliance](https://bitvaria.com/en/tag/compliance/)

Share:

[Back to Blog](https://bitvaria.com/en/blog/)