The fuzzy prompt-injection phrase tier (MR1 / WRD-RES-INJECT-PHRASE) stays opt-in/monitor-only in v0.3 — there is no field false-positive data yet, and default-blocking a fuzzy tier risks alert fatigue.
Blocked on: collecting field FP telemetry on the curated phrase denylist.
Scope (once unblocked)
- Gather FP rate data from real
guard/inspect runs
- If FP rate is acceptable, promote deterministic-enough subset to default-block
- Otherwise keep opt-in and document the decision
Source: docs/THREAT_MODEL_V2.md MR1 / §4.2.
The fuzzy prompt-injection phrase tier (MR1 / WRD-RES-INJECT-PHRASE) stays opt-in/monitor-only in v0.3 — there is no field false-positive data yet, and default-blocking a fuzzy tier risks alert fatigue.
Blocked on: collecting field FP telemetry on the curated phrase denylist.
Scope (once unblocked)
guard/inspectrunsSource: docs/THREAT_MODEL_V2.md MR1 / §4.2.