Government Classification Marking Detection Prompt

This prompt is a first-pass classifier designed for defense contractors, government agency AI system operators, and platform security engineers who must prevent classified or controlled information from entering unauthorized AI processing pipelines. Its primary job is to inspect unstructured text—documents, emails, chat messages, or file uploads—and detect markers for Controlled Unclassified Information (CUI), For Official Use Only (FOUO), Sensitive Compartmented Information (SCI), Special Access Program (SAP) designations, and classified headers at the TOP SECRET, SECRET, and CONFIDENTIAL levels. The prompt belongs at the ingress layer, before any model inference, vector database ingestion, or logging system capture, to prevent spillage incidents that carry regulatory, contractual, and national security consequences.

Use this prompt when you are building an AI pipeline that ingests content from government or defense environments and you need an automated, fast triage step to quarantine suspect content. It is appropriate for systems that process unclassified but sensitive information and must ensure that inadvertently introduced classified material does not leak into commercial cloud models, unencrypted storage, or unauthorized logging streams. The prompt is not a replacement for a formal Data Loss Prevention (DLP) system, a cross-domain solution, or a trained human security reviewer. It is a narrow, high-precision filter that should be paired with downstream quarantine logic, audit logging, and a mandatory human review step for any content that triggers a positive classification match.

Do not use this prompt as a standalone security control or as the sole determinant for downgrading or declassifying content. It is not designed to interpret classification guides, make original classification decisions, or handle derivative classification logic. Avoid deploying it in environments where a false negative could cause a reportable spillage without additional layers of defense. The prompt's output should always be treated as a signal for routing, not as an authoritative classification determination. Before deploying, ensure that your logging and observability infrastructure is authorized to capture the prompt's input and output at the appropriate classification level, and that your quarantine path is tested against known classification marking patterns.

The following prompt template is designed to be pasted directly into your system prompt or classification middleware. It instructs the model to act as a strict, deterministic classifier that scans input text for explicit or malformed U.S. Government classification markings, banner lines, portion markings, and control notices. The model must not summarize, analyze, or continue processing the content—its sole job is detection and routing instruction.

markdownCopy
You are a strict content classifier for a secure AI processing pipeline. Your only task is to scan the provided text for U.S. Government classification markings, control notices, and dissemination controls. You must not summarize, analyze, or repeat the content under any circumstances.

# Classification Taxonomy
Scan for the following markings, including common abbreviations, malformed variants, and legacy designations:
- Top Secret (TS)
- Secret (S)
- Confidential (C)
- Controlled Unclassified Information (CUI) and all CUI categories/sublabels
- For Official Use Only (FOUO)
- Sensitive Compartmented Information (SCI)
- Special Access Program (SAP) and all SAP compartments
- Unclassified//For Official Use Only (U//FOUO)
- Law Enforcement Sensitive (LES)
- Distribution statements (e.g., Distribution D, Distribution X)
- Dissemination control markings (e.g., NOFORN, REL TO, ORCON, PROPIN)
- Any classification banner line (e.g., "TOP SECRET//SI//NOFORN")
- Any portion marking (e.g., "(TS)", "(S//NF)", "(CUI)")
- Declassification instructions (e.g., "DECLASSIFY ON: 20501231")

# Detection Rules
1. Markings can appear in headers, footers, subject lines, body text, or metadata.
2. Malformed markings (e.g., missing slashes, inconsistent casing, typographical errors that still convey classification intent) must be treated as positive detections.
3. If any portion of the input contains a marking, the entire input is considered classified.
4. The absence of a marking does not mean the content is unclassified; only report on what is detected.

# Input
[INPUT_TEXT]

# Output Schema
Return ONLY a valid JSON object with the following structure. No other text.
{
  "classification_detected": boolean,
  "highest_classification_level": "TOP_SECRET" | "SECRET" | "CONFIDENTIAL" | "CUI" | "UNCLASSIFIED_CONTROLLED" | "NONE_DETECTED",
  "detected_markings": [
    {
      "marking": string,
      "type": "BANNER" | "PORTION" | "CONTROL_NOTICE" | "DISTRIBUTION" | "DECLASSIFICATION",
      "excerpt": string,
      "confidence": "HIGH" | "MEDIUM" | "LOW"
    }
  ],
  "routing_instruction": "QUARANTINE_IMMEDIATE" | "ESCALATE_FOR_REVIEW" | "NO_ACTION",
  "rationale": string
}

# Routing Logic
- If classification_detected is true and highest_classification_level is TOP_SECRET, SECRET, CONFIDENTIAL, SCI, or SAP: routing_instruction MUST be "QUARANTINE_IMMEDIATE".
- If classification_detected is true and highest_classification_level is CUI or UNCLASSIFIED_CONTROLLED: routing_instruction MUST be "ESCALATE_FOR_REVIEW".
- If classification_detected is false: routing_instruction MUST be "NO_ACTION".

# Constraints
- Do not output any text outside the JSON object.
- Do not include the original input text in the output.
- Do not describe, summarize, or comment on the content.
- If you are uncertain about a potential marking, set confidence to "LOW" and still report it.
- If the input is empty or contains no text, return classification_detected: false with routing_instruction "NO_ACTION".

To adapt this template for your environment, replace the taxonomy list with your organization's specific classification guide and authorized abbreviations. Update the routing logic to match your spillage response plan—for example, some environments may require immediate session termination and audit log generation in addition to quarantine. The output schema can be extended with fields for spillage_severity, required_notifications, or quarantine_ticket_id if your middleware expects those values.

Before deploying, test this prompt against a golden dataset that includes: correctly formatted banner lines, malformed markings with typos, classification words used in non-classified contexts (e.g., "the secret to success"), and documents with mixed classification levels. False positives on non-classified uses of words like "confidential" are a common failure mode. Implement a human review step for all ESCALATE_FOR_REVIEW outputs and log every QUARANTINE_IMMEDIATE event with the full detection payload for audit purposes.

This prompt must operate as a pre-processing guard—the very first step before any model inference, logging, or storage occurs on the input. The harness should intercept the raw document or message, invoke the classification detection prompt, and branch based on the result. A positive detection must trigger an immediate quarantine path: stop all downstream processing, route the content to an air-gapped or high-side review queue, and prevent any persistence in standard application logs, vector databases, or model context windows. The harness itself should run in an environment authorized for the highest classification level it might encounter, or it must refuse to process content above its authorization boundary.

Model choice and invocation: Use a fast, low-latency model for the detection step—this is a classification task, not a generation task. A model like Claude 3 Haiku, GPT-4o-mini, or a fine-tuned classifier is appropriate. The prompt should be called with temperature=0 for deterministic outputs. Wrap the call in a retry with exponential backoff (max 3 attempts) for transient failures, but never retry on a positive classification result. On timeout or model error, fail closed: route to quarantine. The harness must capture the raw model response, parse the JSON output, and validate the classification_marking_detected boolean and marking_type field against the expected schema before acting on the result.

Validation and logging constraints: After parsing, validate that marking_type is one of the expected enum values (CUI, FOUO, SECRET, TOP SECRET, SCI, SAP, UNCLASSIFIED, etc.). If the model returns an unrecognized marking type, treat it as a potential detection and quarantine. Logging is the highest-risk surface for spillage. The harness must write detection events to a dedicated, access-controlled audit log that records: timestamp, a hash of the input content (never the raw content itself), the detected marking, confidence score, and the routing decision. Never log the input text, prompt, or model response to standard application logs. For high-side deployments, integrate with existing security information and event management (SIEM) systems using structured audit records.

Downstream routing and human review: On positive detection, the harness must return a structured rejection to the calling application (e.g., HTTP 451 Unavailable For Legal Reasons or a custom quarantine status) with a reference ID for the audit record. The quarantined content should be encrypted at rest and accessible only through a break-glass review workflow. For ambiguous detections (confidence below a configurable threshold, e.g., 0.85), route to a human review queue with the content and model reasoning. The review interface must run in an authorized environment. Never use the detection result to automatically downgrade or reclassify content—only to route and quarantine. Before deploying, run a red-team exercise with sample classified documents at each marking level, plus adversarial inputs designed to evade detection (obfuscated headers, partial markings, image-only classification stamps) to establish baseline detection rates and failure modes.