Cloud Access Security Broker

Keep confidential files
out of AI apps

Control supported uploads and downloads by app, file type, size and user. Route legitimate exceptions for review.

Request an AI Security Assessment ← Back to SaaS AI

20+

AI apps with proxy patterns

Rule filter dimensions

Evaluation phases — headers-first fast path

100%

File activity logged regardless of rule match

Rule Filters

Six dimensions to scope
exactly the right traffic

CASB rules can combine any number of filters. Block all uploads to any AI tool, or carve out a precise exception — finance team, Excel files only, under 5 MB — in the same console.

Direction — enforce on uploads only, downloads only, or both. Different teams often have opposite requirements: allow uploads for ideation, block downloads of AI-generated output.
App / category / domain — target a specific catalog app (cat_chatgpt), a whole category (AI Tools), or any domain via exact or glob match.
File type — match by MIME type or extension: PDF, DOCX, XLSX, CSV, source code, images. Wildcards supported (application/*).
File size — set minimum and/or maximum byte thresholds. Block uploads over 10 MB. Allow small snippets while stopping document dumps. Enforced via the streaming byte-counter for partial uploads.
User / group — scope rules to individual users or SCIM-synced groups. Security researchers may be allowed to upload threat intelligence to an AI tool that is otherwise blocked for all employees.
App risk score — set a minimum or maximum risk score gate. Automatically block file uploads to any app scoring above 7.0, regardless of whether it is in the catalog yet.

direction: upload app: cat_chatgpt file_type: application/pdf file_size: >5MB user: finance-group risk_score: >=7

Rule	Direction	Target	Action	Hits
Block large PDF uploads	Upload	AI Tools	Block	84
Block source code uploads	Upload	All AI	Block	31
Warn on DOCX uploads	Upload	AI Tools	Warn	122
Allow approved apps — any file	Both	chatgpt, claude	Allow	2,841
Block high-risk app uploads	Upload	Risk ≥ 8.0	Block	9

Streaming Enforcement

Headers-first fast path.
Byte-counter kills the connection.

CASB evaluation has two phases — a lightweight headers check before the request body arrives, and a streaming byte-counter that enforces size limits in real time without buffering the full file.

Phase 1 — Fast Path

Headers-only evaluation

Before the request body arrives, CASB reads Content-Type and Content-Length headers. If the declared file type or size already violates a rule, the connection is cut immediately — zero body bytes are transmitted to the AI app.

Phase 2 — Streaming

Byte-counter enforcement

When the size is not declared in headers (chunked uploads, streaming multipart), the byte-counter accumulates bytes as they stream through. The instant the counter crosses the configured threshold, the connection is terminated mid-stream — no buffering, no memory pressure.

Discovery events always logged — every file activity is recorded regardless of whether a CASB rule fires. This gives you a complete inventory of what files are being transferred to which apps, even before you write a policy.
Risk-score gate — rules can specify a minimum or maximum app risk score. This means you can enforce file-transfer policy on any high-risk app — even newly discovered apps not yet in the catalog — based on their computed risk score alone.

Uploads

1,284

Blocked

Cut mid-stream

User	App	File	Size	Result
j.sharma	ChatGPT	Q4_Forecast.xlsx	2.1 MB	Blocked
l.chen	Claude	contract_draft.pdf	840 KB	Cut @ 500KB
r.müller	Gemini	architecture.py	28 KB	Blocked
p.anand	Copilot	meeting_notes.docx	112 KB	Warned
s.liu	ChatGPT	logo_final.png	64 KB	Allowed

How It Works

CASB enforcement in four steps

File transfer detected by the extension

When a user attaches a file or pastes content in an AI app, the browser extension intercepts the request. It identifies the app, the transfer direction, and the file metadata (type and size from headers if available).

Phase 1: headers-only fast path

CASB checks Content-Type and Content-Length against matching rules before the body is transmitted. If a rule matches on file type or declared size alone, the connection is terminated immediately. Zero bytes of the file body reach the AI app.

Phase 2: streaming byte-counter

For uploads where the size isn't declared in advance (chunked, multipart), the byte-counter accumulates data as it streams. When the running total crosses the configured threshold, the connection is cut — protecting against oversized uploads that arrive in pieces.

Discovery event logged regardless of action

Every file activity — blocked, warned, or allowed — is logged as a discovery event with app, user, direction, file type, size, and the rule that matched (if any). This builds a complete inventory of AI file transfer activity over time.

Capability Comparison

AIGuard CASB vs. traditional CASB

Capability	AIGuard CASB	Traditional CASB	Browser DLP	Network DLP
AI-specific app catalog (20+ apps)	✓	Limited	—	—
Directional control (upload/download)	✓	✓	Upload only	✓
Streaming byte-counter enforcement	✓ Real-time	—	—	Buffered
Headers-only fast path	✓	—	—	—
Risk-score-based enforcement	✓	—	—	—
Discovery events (always logged)	✓	Limited	—	Network only
File type + size combined filters	✓	✓	Type only	✓
User + group scoping	✓	✓	Limited	✓

FAQ

Common questions

CASB does not perform content inspection — it enforces rules based on file metadata: type (MIME/extension), size, direction, app, and user. For content-level inspection (detecting PII or sensitive text inside a document), use DLP rules in combination with CASB. The two layers are designed to work together: CASB blocks oversized or wrong-format files at the network level, while DLP inspects the content of permitted transfers.

CASB can match any MIME type or file extension — including PDF, DOCX, XLSX, CSV, JSON, source code extensions (.py, .js, .ts, .go, etc.), images (JPEG, PNG, SVG), and archives (ZIP, TAR). You can also use wildcards such as application/* to match all binary files. The MIME type is read from the Content-Type header; extension matching is a fallback for uploads with generic content types.

For chunked or multipart uploads where the full size isn't declared in advance, AIGuard runs a streaming byte-counter in the extension. As each chunk arrives, the counter increments. The moment the running total crosses the configured maximum, the outbound connection is terminated mid-stream — no buffering required. The user sees a "File transfer blocked" notification, and the event is logged with the bytes received before cut.

Yes. CASB is a standalone module within the SaaS AI Security tier. It operates independently of DLP — enforcing file transfer rules based on metadata alone. Many customers start with CASB to stop large document uploads, then layer in DLP for content inspection of smaller permitted transfers once their policy matures.

All file transfer activity is logged as discovery events in the console regardless of whether any rule matches. You can review discovery events to understand your organization's AI file transfer patterns — which apps, which file types, which users — and use that data to inform your rule authoring. Discovery events are retained for 90 days by default and are exportable.

Keep confidential filesout of AI apps

Six dimensions to scopeexactly the right traffic

Headers-first fast path.Byte-counter kills the connection.