Prompt writing & security classification Q&A!

Hey Box Community!

We know that keeping your enterprise data secure while leveraging the power of AI is top of mind for everyone right now. Recently, we gathered some of your most pressing questions about Box Shield Pro, Box AI, and automated security classifications from our recent prompt writing workshop.

Whether you are wondering how to write the perfect classification prompt, how to control AI exposure, or how to handle years of uncategorized legacy files, we've got you covered! Check out the full Q&A breakdown below. 👇

📋 Policy & Setup

• Q: We have a data classification policy and detailed Data inventory. Could we attach both documents to the classification prompt?

  • A: Currently, we do not support attaching external documents like a data inventory or data dictionary directly to the classification agent. However, you can incorporate this information directly into the classification prompt itself! Box supports prompts up to 25,000 characters, which provides a generous amount of space for detailed instructions. If your data inventory is exceptionally robust and exceeds this limit, it may not be fully supported today, but this is an area we are actively exploring for future product enhancements.

• Q: How do I add classifications after years of not using them?

  • A: This is a very common scenario! When you turn on Box Shield's automated classification, it automatically covers all net-new content and any existing content that experiences user activity from that point forward. To address older, "stale" content that hasn't been touched in years, we are launching a retroactive scanning capability in a little over two months. Delivered through Box Consulting, this service will perform a one-time scan of your historical data to apply the appropriate classification labels.

• Q: Are AI Units consumed when using AI to help apply classifications?

  • A: No, AI Units are not consumed during normal, day-to-day automated classification with Box Shield Pro. However, please note that the upcoming retroactive scanning capability (delivered via Box Consulting in just over two months) is consumption-based and will consume AI Units as a one-time charge.

🤖 Controlling AI Exposure & Custom Agents

• Q: Can Box labels/classifications be used to control AI exposure?

  • A: Yes! We are actively working on two major improvements over the next few months to help you protect your classified content:

    1. Shield Access Policies for External AI: We are expanding our existing Box Shield "integration restrictions" policy. While the current policy prevents external applications from downloading classified content, the upcoming enhancement will also block "read" access. This ensures that external AI applications (such as Claude or ChatGPT) cannot read or ingest your sensitive, classified files even if they do not download them. This capability is planned for early next quarter.

    2. Filters for Box Custom Agents: If you build a Box Custom Agent (for example, to generate marketing copy), you will soon have the ability to filter out classified content. This ensures the agent never references or accesses confidential files when generating content.

✍️ Prompt Writing & Best Practices

• Q: What are the most common mistakes customers make when rewriting label definitions for AI-based classification?

  • A: The most common mistake is copying corporate data classification policies verbatim into the prompt without resolving overlapping criteria. Corporate policies are often highly detailed, and different classification tiers (such as "Confidential" and "Restricted") can have overlapping definitions. When definitions overlap, the AI may struggle to choose consistently between them. To ensure highly accurate and consistent results, it is critical to refine your prompt so that the definitions and criteria for each label are distinct, descriptive, and mutually exclusive.

• Q: Prompts for efficient Service Delivery where Security stance is made clear to the customer?

  • A: One of the unique advantages of AI-based classification with Box Shield Pro is its transparency. When content is classified, the system can actually explain to the user the exact reasoning behind the classification. This transparency significantly reduces friction, as users immediately understand why a file was secured (e.g., why they cannot download or share it externally) rather than feeling blocked by an arbitrary policy. Additionally, you can customize the descriptions of your classification labels so that end-users always have clear visibility into the security restrictions associated with each label.

• Q: Are there federal government classification strategies?

  • A: Yes! Box Shield Pro is highly flexible and can be tailored to meet specific federal requirements, such as identifying Controlled Unclassified Information (CUI). The key to a successful federal classification strategy is having a clear understanding of what content you need to classify and how those labels should tie into your broader security policies. Once you have defined those parameters, it is simply a matter of crafting the right prompt to guide the AI precisely.

🔍 Testing, Monitoring & Advanced Use Cases

• Q: What level of testing or validation should teams do before rolling AI Classification into production?

  • A: We recommend a phased testing approach:

    • In-UI Testing: Test your prompts directly within the policy configuration user interface using sample files.

    • Pilot Folder Testing: Apply the policy to a test folder or an active pilot folder containing a diverse, representative sample dataset to see how it performs across a broader range of files.

    • Monitoring Mode: When you are ready to associate security access policies with your new labels, deploy those access policies in "monitoring mode" first. This allows you to audit the downstream impact and catch any potential false positives before they interrupt your users' daily workflows.

• Q: How should teams decide between traditional classification and AI Classification? Which use cases belong in each?

  • A: The choice depends entirely on the complexity of your content:

    • Traditional Classification is ideal for straightforward, pattern-based use cases. It supports keyword matching, file extension filters, and over 16 out-of-the-box data types (such as US/Canadian PII, passport numbers, and bank routing numbers).

    • AI Classification is best when you need to go beyond simple string matching. Instead of just looking for a specific keyword like "confidential" (which can lead to high false positives), AI classification understands the overall context and meaning of a document, allowing you to identify and secure sensitive content with much greater precision.

• Q: Have you seen examples of content being classified based on location, for example, domestic vs overseas content?

  • A: While Box Shield does not support geolocation-based classification today (i.e., classifying a file based on where it was created or accessed), we do offer Shield threat detection rules to monitor suspicious sessions and locations. Furthermore, because Box AI classifies content by analyzing the actual information inside the file, you can easily set up your classification prompts to detect and label files based on any domestic or overseas location details mentioned within the document text itself.

• Q: Is there a way to monitor when a classification has changed and we want to trigger events?

  • A: Yes, you can monitor classification changes in real time using our Events API. Whenever a classification label is modified, an event is generated that you can easily stream into your Security Information and Event Management (SIEM) tool. Additionally, Box provides classification reports that offer excellent visibility and auditability over label changes across your enterprise.

• Q: Can you get alerted if a prompt changes the results of a classification?

  • A: While we do not have direct, out-of-the-box alerting for classification changes today, you can easily set up custom alerts through your SIEM solution by leveraging our Events API. To prevent unwanted changes, Box Shield allows you to configure whether automated policies can overwrite user-applied labels or skip them. Additionally, you can restrict who is allowed to modify classification labels based on their collaborator roles (for example, restricting modifications only to owners/co-owners, or limiting them strictly to administrators).

Have more questions about Box Shield, Box AI, or security classifications? Drop them in the comments below! 👇✨