Module dlp 

Data-loss-prevention (DLP) primitives.

Layered detection for outbound LLM traffic:

• L1 scan() — deterministic regex scan (secrets, Korean PII, filesystem paths) returning byte spans, categories, severity, and an overall Sensitivity.
• L2 fingerprint (feature dlp-fingerprint) — cosine-match outbound content against registered sensitive-document embeddings.
• L3 ContentClassifier — trait for an optional local classifier on ambiguous cases.
• Policy policy::lookup — map a provider DataPolicy + Sensitivity to a PolicyAction.

use llm_kernel::dlp::{Sensitivity, scan};

let report = scan("Authorization: Bearer abcdefghijklmnopqrstuvwxyz012345");
assert!(report.sensitivity >= Sensitivity::Confidential);

Re-exports

pub use crate::provider::policy::Sensitivity;

pub use policy::DataPolicy;

pub use policy::ImagePolicy;

pub use policy::PolicyAction;

pub use policy::PolicyThreshold;

pub use policy::lookup;

pub use scan::Finding;

pub use scan::FindingCategory;

pub use scan::ScanReport;

pub use scan::Severity;

pub use scan::Span;

pub use scan::apply_redactions;

pub use scan::scan;

Modules

classifier

L3 — optional local classifier for ambiguous content. L3 — optional local classifier for ambiguous content.

fingerprint

L2 — fingerprint matching of registered sensitive documents. L2 — fingerprint matching of registered sensitive documents.

policy

Policy resolution — DataPolicy + Sensitivity → PolicyAction. Policy resolution — map a DataPolicy + Sensitivity to a PolicyAction.

scan

L1 — deterministic content scan. L1 — deterministic content scan.