>
    Strata Copilot
    Configure Allow, Alert, and Block Actions for AI Security Profile Detectors
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma AIRS
    3. AI Runtime Security
    4. AI Runtime Security API Intercept
    5. Configure Allow, Alert, and Block Actions for AI Security Profile Detectors
    Download PDF
    Prisma AIRS

    Configure Allow, Alert, and Block Actions for AI Security Profile Detectors

    Table of Contents

    Configure Allow, Alert, and Block Actions for AI Security Profile Detectors

    Configure standardized Allow, Alert, and Block actions across AI Security Profile detectors—including granular multi-category controls for Prompt Injection Detection—to enforce threats, monitor detections without blocking traffic, suppress expected noise, and distinguish alerted vs. blocked scans.
    Where Can I Use This?What Do I Need?
    • Prisma AI Runtime Security
    • Prisma AIRS AI Runtime Security license
    • AI Runtime Security deployed (API intercept)
    Overview
    AI Security Profiles now standardize detector behavior into three distinct actions:
    • Allow: Permits traffic to pass without recording a security violation. Log severity is not applicable (N/A), and the scan verdict returns as benign.
    • Alert: Permits traffic to pass while recording a violation and generating a log at the configured severity. The scan response returns action: allow with verdict: malicious (category: malicious), enabling you to validate new policies and monitor threats in production without disrupting legitimate traffic.
    • Block: Intercepts and stops the request, records a violation at the configured severity, and returns action: block with verdict: malicious (category: malicious).
    Action availability varies depending on the detector type. While Alert is supported across all detectors (except Latency), the full set of actions (Allow, Alert, and Block) is available only for Prompt Injection (Custom mode, per sub-category), Database Security, Toxic Content, Custom Topic Guardrails, and Malicious URL (Advanced). All other detectors support Alert and Block actions only.
    In addition, Prompt Injection Detection supports multi-category configurability, allowing you to switch between Standard mode (uniform Alert or Block action across all injection vectors) and Custom mode (independent Allow, Alert, or Block actions and severities across six distinct prompt injection sub-categories).
    Note: Existing profiles continue operating without interruption. For existing profiles configured with Allow on detectors where Allow previously generated a violation (such as Sensitive Data Detection or Malicious Code Detection), Strata Cloud Manager automatically updates the label to Alert.
    To prevent an enabled detector from being silently neutralized, Strata Cloud Manager displays an inline validation warning "Allowing all actions effectively disables this detection. Please update your configuration." and disables the Create or Save Changes button if every category, confidence level, or operation is set to Allow.
    Configure Detector Actions in an AI Security Profile
    Follow these steps to create or update an AI Security Profile with Allow, Alert, and Block actions:
    1. In Strata Cloud Manager, go to AI SecurityAI Runtime APIConfigurations.
    2. Click + Create New to create a profile, or select an existing profile and click Edit (or click the Edit pencil icon in the Actions column).
    3. Enter a Name for the profile.
    4. Under the AI Security tab, toggle Enabled on for the required detectors and configure their actions:
      1. Prompt Injection Detection: Select Standard (Alert or Block) or Custom to reveal the six-category configuration table, where you can assign Allow, Alert, or Block and a log severity (Low, Medium, High, or Critical) to each sub-category.
        Selecting Allow automatically sets that row's Severity to N/A.
        At least one category must be set to Alert or Block. If all six categories are set to Allow, the UI displays the error "Allowing all actions effectively disables this detection. Please update your configuration." and disables the Create button.
      2. Malicious URL Detection: Choose Basic (Alert or Block) or Advanced (set the default action to Allow, Alert, or Block, and click + under URL Security Exceptions to add category exceptions with a different action).
      3. Sensitive Data Detection: Choose Basic or Advanced and select Alert or Block.
      4. Database Security Detection: Configure Allow, Alert, or Block individually for Create, Read, Update, and Delete.
      5. Malicious Code Detection, Source Code Detection, and AI Agent Protection: Select Alert or Block and choose a severity (Low, Medium, High, or Critical).
        The severity applies to Alert and Block actions only.
    5. Select the Content and Brand Safety tab and configure the required detectors:
      1. Toxic Content Detection: Choose Standard or Custom and assign Allow, Alert, or Block per category/confidence level. Setting an action to Allow sets its severity to N/A.
      2. Contextual Grounding: Select Alert or Block and choose a severity.
      3. Custom Topic Guardrails: Select the default action (Allow, Alert, or Block) when no topic is matched. Click + under Topic Exceptions to add topics and assign them one of the other two actions.
        A topic cannot use the same action as the default action:
        • If the default action is Block, topics can only be set to Allow or Alert.
        • If the default action is Allow, topics can only be set to Alert or Block.
      Note: When multiple detectors or prompt injection sub-categories trigger on a single request, the most restrictive action takes precedence:
      • If any detector or sub-category triggers Block, the overall scan result is block (malicious), and the reported severity is the highest severity among the triggered Block rules.
      • If nothing blocks and at least one rule triggers Alert, the overall scan result is allow with verdict malicious, and a violation is recorded using the highest severity among the triggered Alert rules.
      • If all triggered rules are set to Allow, the result is allow (benign) and no violation is recorded.
    6. Verify there are no inline validation warnings (such as all rows set to Allow), then click Create or Save Changes.
    Upon saving, click the profile name in the Security Profiles table to inspect the read-only summary, which displays each enabled detector (including Prompt Injection Detection (Custom)) alongside its configured action badges (Allow, Alert, or Block) and severities.
    Note:
    • Existing profiles configured with Allow on detectors where Allow previously generated a violation automatically update their label to Alert. When editing an existing profile, ensure no detector has all rules set to Allow before saving.
    • If a prompt injection is detected, the detected sub-categories will be present in the scan API response.

    © 2026 Palo Alto Networks, Inc. All rights reserved.