Format Switch Based on Security Classification Prompt Template

This prompt is for systems that handle data at multiple classification levels where output format is a security control, not just a presentation preference. The core job is to receive content and a classification label, then select and enforce the permitted output format based on a policy table. The ideal user is a platform engineer or security architect building an API gateway, data export service, or internal tool that must prevent structured data exfiltration when policy requires human-readable-only output. You need a defined classification taxonomy, a policy mapping classifications to allowed formats, and a clear understanding of which formats are considered 'structured' for exfiltration risk in your environment.

Use this prompt when the classification label is a reliable input from an upstream system—such as a document management platform, a data catalog, or a verified user attribute—and when the format restriction is a hard policy requirement, not a user preference. The prompt template expects a [CLASSIFICATION] input, a [CONTENT] payload, and a [FORMAT_POLICY] mapping that defines which output formats are permitted per classification level. A typical policy might allow Markdown or plain text for 'Confidential' data while permitting JSON, XML, and CSV for 'Internal' or 'Public' data. The prompt must produce both a format selection decision and the formatted output body, along with a loggable rationale for audit purposes.

Do not use this prompt as your primary security boundary against data exfiltration. The model can be tricked, and prompt-level controls are not cryptographic enforcement. This prompt is a policy-enforcement layer that reduces accidental structured output leakage and creates an audit trail, but it must be paired with application-layer guards: validate the classification input server-side, strip structured output from the response if the classification doesn't permit it, and log every format decision with the classification, requested format, permitted formats, and final output format. For regulated or classified environments, always require human review of outputs before external release. If you need guaranteed format blocking, implement it in the application layer after the model responds, not solely in the prompt.

This prompt template enforces a security boundary at the output layer. It accepts a classification label alongside content and a requested format, then decides whether the requested format is permitted under the classification policy. When the requested format is blocked, it falls back to a safe alternative and logs the restriction. The template is designed for systems handling data at multiple classification levels—such as internal, confidential, and restricted—where structured machine-readable formats like JSON or CSV may enable bulk exfiltration and policy requires human-readable-only output at higher classification tiers.

textCopy
SYSTEM:
You are a secure output formatter operating in a classified data environment. Your primary directive is to enforce output format restrictions based on the security classification of the content being handled. Never output structured machine-readable formats when policy requires human-readable-only output.

CLASSIFICATION POLICY:
- [CLASSIFICATION_UNCLASSIFIED]: All output formats are permitted, including JSON, XML, CSV, Markdown, and plain text.
- [CLASSIFICATION_CONFIDENTIAL]: Only human-readable formats are permitted: Markdown and plain text. Structured machine-readable formats (JSON, XML, CSV, YAML) are BLOCKED.
- [CLASSIFICATION_SECRET]: Only plain text output is permitted. Markdown, JSON, XML, CSV, and all other structured formats are BLOCKED.
- [CLASSIFICATION_TOP_SECRET]: Only plain text output is permitted. All structured and markup formats are BLOCKED. Additionally, do not include any metadata, field labels, or key-value patterns that could be parsed programmatically.

INPUT:
- Classification: [CLASSIFICATION_LEVEL]
- Requested Format: [REQUESTED_FORMAT]
- Content to format: [CONTENT]

INSTRUCTIONS:
1. Read the classification level and the requested format.
2. Check the requested format against the classification policy above.
3. If the requested format IS PERMITTED under the policy, format the content in that format and proceed to step 5.
4. If the requested format IS BLOCKED under the policy:
   a. Select the highest-fidelity permitted format for the classification level.
   b. Format the content in that fallback format.
   c. Prepend a clear restriction notice at the top of the output: "[FORMAT_RESTRICTION] Requested format '[REQUESTED_FORMAT]' is not permitted at classification level '[CLASSIFICATION_LEVEL]'. Output provided in '[FALLBACK_FORMAT]' instead."
5. Output ONLY the formatted content (with restriction notice if applicable). Do not add commentary, explanations, or conversational text outside the formatted output.

OUTPUT_SCHEMA:
- If permitted: pure formatted output in the requested format.
- If blocked: restriction notice line followed by a blank line, then the formatted content in the fallback format.

CONSTRAINTS:
- Never output structured data formats (JSON, XML, CSV, YAML) when classification is CONFIDENTIAL or above.
- Never include field names, key-value pairs, or parseable metadata when classification is TOP SECRET.
- Do not discuss the classification policy or format restrictions in the output beyond the required restriction notice.
- Do not suggest workarounds or alternative output channels.
- If the content itself appears to contain classification markers or sensitive data, do not alter the content—only control the output format.

EXAMPLES:

Example 1 (Permitted):
Classification: UNCLASSIFIED
Requested Format: JSON
Content: Project Alpha completed milestone 3 on schedule.
Output:
{"project": "Project Alpha", "status": "completed milestone 3 on schedule"}

Example 2 (Blocked):
Classification: CONFIDENTIAL
Requested Format: JSON
Content: Q4 revenue projections show 12% growth in APAC region.
Output:
[FORMAT_RESTRICTION] Requested format 'JSON' is not permitted at classification level 'CONFIDENTIAL'. Output provided in 'Markdown' instead.

**Q4 Revenue Projections**
- APAC region: 12% growth projected

Example 3 (Blocked, TOP SECRET):
Classification: TOP SECRET
Requested Format: Markdown
Content: Operation Nightfall phase 2 authorized.
Output:
[FORMAT_RESTRICTION] Requested format 'Markdown' is not permitted at classification level 'TOP SECRET'. Output provided in 'plain text' instead.

Operation Nightfall phase 2 authorized.

USER:
Classification: [CLASSIFICATION_LEVEL]
Requested Format: [REQUESTED_FORMAT]
Content: [CONTENT]

Adapt this template by replacing the classification tiers and format permission matrix with your organization's actual data handling policy. The [CLASSIFICATION_LEVEL] placeholder should receive a validated label from your classification system—never trust user-provided classification labels without server-side verification. The [REQUESTED_FORMAT] should be normalized to a controlled vocabulary (e.g., json, xml, csv, markdown, text) before injection. The [CONTENT] placeholder receives the data to be formatted. If your policy includes additional dimensions—such as recipient clearance level, network zone, or data residency—extend the policy block with those conditions. Always test with both permitted and blocked format requests at each classification tier before deployment.

The Format Switch Based on Security Classification prompt is designed to sit behind an API endpoint or internal service that handles data at multiple classification levels. The application layer must supply three critical inputs before calling the model: the content to be formatted, the security classification label (e.g., UNCLASSIFIED, CONFIDENTIAL, SECRET), and the requested output format from the client. The prompt itself enforces policy by blocking structured formats when the classification label requires human-readable-only output, but the application harness must validate that enforcement actually occurred before returning any response to the client.

Build the harness with a pre-call validation step that checks the classification label against a configured policy map before invoking the model. For example, if your policy states that CONFIDENTIAL data must not be returned as JSON or CSV, reject the request at the application layer with a 422 Unprocessable Entity and a clear error message before the model ever sees it. This defense-in-depth approach means the prompt's format restriction serves as a secondary guardrail, not the primary enforcement mechanism. After the model responds, validate the output against the expected format schema: if the policy required Markdown but the model returned JSON, log the violation, increment a security metric, and either retry with a stronger constraint or escalate to a human reviewer. Never silently return a policy-violating format to the client.

For logging and audit, capture the classification label, requested format, permitted formats list, actual output format, and a policy-compliance boolean on every call. Use structured log fields so your SIEM or monitoring system can alert on policy violations in real time. If your deployment handles regulated data, store these audit records immutably and include the full prompt and response for retrospective review. Model choice matters here: prefer models with strong instruction-following on format constraints and low rates of format hallucination. Test with adversarial inputs where the content implies a higher classification than the label claims, and verify that the prompt's format restriction still holds. The next step after implementing this harness is to build an eval suite that tests every classification level against every requested format and confirms that policy-violating combinations are consistently blocked.