Frequently Asked Questions About AI Runtime Protection

Does Island cover AI built into productivity suites and enterprise AI accounts?

Supported Microsoft 365 web applications run through browser or network inspection, and native Microsoft 365 applications can use compatible network inspection. For enterprise AI accounts, Island's provider integrations retrieve interaction records from ChatGPT Enterprise, from Claude through the Claude Compliance API, and from Microsoft Copilot. Island also ingests OpenTelemetry data and Amazon Bedrock invocation logs. These sources report after the fact. They add audit coverage and alerts for activity outside Island's inline paths, and each provider integration needs that provider's enterprise licensing and administrator permissions.

How does Island work with an LLM gateway we already run?

Island integrates with LLM gateways such as LiteLLM and Kong and inspects the events the gateway forwards to it. When the gateway calls Island synchronously and honors the verdict, the decision applies inline, and model and version allowlisting applies wherever the gateway exposes those values. Applications can also call Island's API directly, and supported integrations handle streaming model traffic.

How is AI Runtime Protection different from an AI firewall or an LLM gateway?

A firewall or gateway inspects the traffic routed through it, one request at a time. AI Runtime Protection runs at the gateway too, through the Island MCP Gateway and LLM gateway integrations, and adds what a gateway cannot see: the browser session, the files an agent touched on the endpoint, and the tool calls before and after, all tied to one identity. Each verdict draws on the whole session, and one policy engine applies at every control point.

Can Island protect AI use in development, test, and build environments?

The same runtime integrations work in development, test, staging, and continuous integration (CI) environments, including cloud workloads, through network or gateway inspection and supported hooks. Background and scheduled agent runs get the same inspection when they use a connected path. On Linux, Island covers activity through network inspection and separately installed hooks.

What sensitive data can Island detect?

Island's data loss prevention (DLP) detectors find personal data, payment data, secrets, and source code, along with regional identifiers such as International Bank Account Numbers (IBANs) and national identification numbers. Organizations can add their own data types, match exact values from their own records, and fingerprint documents. Where a control point can read a Microsoft Purview sensitivity label, policy can use the label alongside the detectors, and semantic classifiers complement the patterns, labels, and exact matches. Administrators can tune DLP sensitivity for supported data types.

Does Island inspect files, images, and responses as well as typed prompts?

DLP inspects files uploaded to AI services through supported browser and network paths, and it reads the text inside images with optical character recognition (OCR). Clipboard and paste controls apply in supported browser paths and in Windows desktop applications. On the way back, DLP, security guardrails, and content moderation check model responses, and Island checks tool arguments for sensitive data wherever an inline path sees them before they reach their destination.

Does Island catch prompt injection hidden in documents, web pages, and tool results?

Security guardrails inspect retrieved content and tool results for indirect prompt injection when an integration exposes that content, and an inline path can withhold or replace a poisoned result before the model reads it. The same guardrails flag direct prompt injection, jailbreak attempts, and attempts to extract a system prompt, while DLP scans the content for secrets and other sensitive data.

Can Island enforce acceptable-use rules on AI content?

Yes. Administrators turn on a content moderation model per policy and choose the acceptable-use categories it looks for, and supported custom classifiers extend it. Moderation also applies to text that Island extracts from images and files.

Does Island inspect a tool call before it runs?

Yes, wherever Island sits in front of the action. The MCP Gateway inspects each routed tool call, including its arguments and the user and agent behind it, before forwarding it. For local actions, pre-tool hooks in supported agents inspect file, shell, and local MCP actions before they execute. Either one can deny a destructive or prohibited action at that point.

What happens when a prompt, response, or tool call breaks policy?

Every inline path can block the violating request, and every path, including the ones that report after the event, can raise an alert. On browser, Island Extension, and SWG paths, Island can instead mask the sensitive value and let the cleaned request through. Masking swaps the value for the name of the detector that found it, so the model keeps the context. For tool calls, Island can deny the call before forwarding it or withhold a returned result. In the browser, the person sees an explanation of the block. Supported agent and MCP integrations return a structured decision or tool feedback to the agent, and each verdict names the guardrail or detector that triggered it.

How do teams target and roll out policies?

Policy can target applications, services, teams, users, and models, weigh that context against how sensitive the content is, and draw on group membership from the organization's identity provider. A new policy can run in observe-only mode first, then reach selected users and groups before it applies to everyone. Every policy keeps a version history with rollback, and teams manage policies in the Island Management Console, through the API, or as code with Terraform. A change applies to every later request on each enforcing path.

How does Island's own detection work, and where does it run?

Island pairs deterministic DLP detectors with machine learning models for DLP, security guardrails, and content moderation, and it maintains detections for prompt injection, data leakage, unsafe actions, and policy violations. Those models run in Island's own cloud services, as do the topic classification and summaries used in analytics. Island tests its platform and its detection components against synthetic and adversarial data sets.

What investigation tools does Island provide?

Every captured conversation keeps its identity and session context, whether it came through the browser, the Island Extension, network inspection, or an agent integration. Security teams can drill into a conversation, replay the retained prompts and tool events behind it, and follow a long session by topic, with prompt, response, and tool events correlated by user, session, and agent. A sessions view lists AI conversations across the organization by application, user, title, and the MCP servers involved. Analysts can assign, annotate, and close incidents, and export the underlying records for review elsewhere.

Can Island send events and alerts to our security operations tools?

Island streams normalized events and alerts to security information and event management (SIEM) platforms, including Splunk, Microsoft Sentinel, and Google Security Operations, and routes alerts through webhooks and email. Security orchestration, automation, and response (SOAR) and ticketing workflows connect through the same events and webhooks and through Island's APIs.

What reporting shows how policies perform?

Dashboards break down enforcement outcomes (allowed, blocked, warned, and monitored) by policy, detector, application, and user. Role-based dashboards and scheduled reports give security, governance, and executive teams their own view of the same data.

Can Island supply evidence for compliance reviews?

Island exports policy, event, and review evidence, along with inventory and control data, that compliance teams can map to the frameworks and regulations they answer to. Policy version history documents how controls changed over time, and teams can connect the exports to their governance, risk, and compliance (GRC) platform through Island's APIs.

What happens to the AI content Island captures?

Island's cloud inspection and analytics services receive the content a configured integration captures: prompts, responses, tool arguments and results, files, and identity and device details. Model requests still go to the provider the organization chose. Administrators decide how much Island keeps, whether full content, reduced or redacted content, or only metadata and verdicts, and they set the retention period. Captured content can stay in regional storage or in the organization's own storage, and Island encrypts data in transit and at rest.

Who can see captured prompts, and how is administration controlled?

Administration is role-based, with delegated access for teams and business units and an audit log of administrative actions. Prompt content has its own viewing role: the console masks it for everyone else, and Island audits each time an authorized person unmasks it. Multi-tenant organizations manage separate tenants from one place, with policy inheritance from a parent tenant where supported.

Is Island independently audited?

Yes. Island has completed a System and Organization Controls (SOC) 2 Type II assessment and holds ISO/IEC 27001 certification. Current reports, certificates, and other security documentation are available through the Island trust portal at trust.island.io.

How does Island fit with the security tools we already run?

Island works with the identity provider, endpoint detection and response (EDR) platform, model providers, and LLM gateways an organization already has. It delivers inspection, the MCP Gateway, and analytics as a multi-tenant cloud service with optional endpoint components, and one console covers browser, endpoint, network, gateway, provider, and telemetry controls for management and investigation. Rollout runs in phases. Teams usually start with identity, endpoint and browser deployment, and discovery. Monitoring and a first set of policies come next, then MCP and workload integrations, telemetry, and SIEM reporting. Each phase can target specific user groups through the deployment tools already in place.