This rule detects Cisco AI Defense prompt events that were allowed and matched a privacy guardrail for personally identifiable information (PII) or payment card data (PCI). Such events indicate sensitive information may have been submitted to an AI application and should be reviewed against organizational data handling policies. The detection ingests Cisco AI Defense alerts, filters for allowed prompt actions, extracts contextual fields (guardrail rule types, guardrail entities, application and connection identifiers, policy name, and event time), and narrows results to events that mention PII or PCI guardrails. The search groups results into ten-minute windows by application and connection to reduce duplicates, reporting counts, distinct events, time range, and key metadata such as guardrail types, entities, and policies. The finding summarizes the volume and scope of sensitive prompts observed and links to the corresponding application and connection for investigation. The search also provides drilldown and testing context: it includes a true positive test using Cisco AI Defense alert data and notes potential false positives from authorized testing or demonstrations. The rule is intended for analysts to review data handling compliance when sensitive content is processed by GenAI systems. Overall, this rule supports data protection and abuse monitoring for GenAI prompt interactions, with the detection implemented in Splunk as part of Splunk Enterprise Security and Splunk Cloud implementations that ingest Cisco AI Defense alerts.