Why it matters
Prevention is layered: retrieval scope, citations, contracts, abstention, prohibited claims, monitoring. One layer alone leaks. Honest stakeholders know risk is reduced, not erased.
Vendor safety marketing does not replace tests with your knowledge and policies.
Prevention marketing from vendors exceeds what any stack guarantees. Your prevention story must be honest: reduced risk through layered controls and measurement.
Incidents should enlarge prevention scope. One missing abstention test is worth more than ten prompt adjectives.
How it works
Require citations on factual intents, enforce contracts on high-risk domains, test refusals on empty retrieval.
Red-team quarterly with adversarial and social engineering prompts.
Publish monthly scorecards: citation rate, abstention rate, contract pass rate, stale sources.
Add tests from every incident before closing tickets.
Run prevention drills: empty index, stale policy, conflicting sources, social engineering. Drills expose weak layers before customers do.
Pair engineering controls with author training on public-safe publishing and shadow copies that bypass CMS workflow.
Example
Nintendo prevention stack blocks pricing answers without Pricing FAQ retrieval, strips guarantee language via contract rules, and refuses legal advice intents with handoff to human support.
Common mistakes
- 1Prevention equated with better system prompt only
- 2Contracts defined but not wired to enforcement
- 3No refusal tests for empty retrieval cases
- 4Overpromising customers that AI cannot be wrong
Test the answer before your customer does.
Run answer tests and evaluations against your governed knowledge before you ship.
See answer evaluations