> ## Documentation Index
> Fetch the complete documentation index at: https://docs.promptguard.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Admin Path

> Set up PromptGuard for your organization from the dashboard alone, in the order an admin does it: sign-in, roles, policies, retention, alerts, SIEM and audit. No code.

> [!NOTE]
>
> **For the person who owns AI security policy, not the code.** Every step here
> is done in the dashboard at [app.promptguard.co](https://app.promptguard.co).
> Each one names the screen, gives the minimum to do there, and links the page
> with the detail. Work top to bottom: who can sign in comes before who can
> change policy, and policy comes before where its alerts go.

You need the **Owner** or **Admin** role in the organization. Some steps need
a plan that includes the feature; each says which feature, and
[Pricing](https://docs.promptguard.co/pricing.md#feature-comparison) says which plans have it. Managing
client organizations as a provider? Start with the [MSP guide](https://docs.promptguard.co/platform/msp.md);
the steps below then apply inside each client.

## 1. Connect sign-in to your identity provider

**Settings → SSO.**

1. **Configure SSO** opens a hosted portal where you connect Okta, Microsoft
   Entra ID, Google Workspace or another SAML or OIDC provider, and set the
   email domains allowed to sign in.
2. **Configure Directory Sync** connects SCIM, so people you add or remove in
   your directory are added to or removed from PromptGuard. Removal ends
   access at once.
3. Sign in once with a test account from your identity provider.

Needs SSO on your plan. Detail: [Single sign-on](https://docs.promptguard.co/platform/sso.md),
[Directory Sync](https://docs.promptguard.co/platform/scim.md).

## 2. Give people the least role they need

**Organization → Team.** Invite people, or let Directory Sync add them as
**Members**, then set each role: **Owner**, **Admin**, **Member** or
**Viewer**. Members can change policies and keys; Viewers can only look.

* **One project only:** add the person as a **Viewer**, then give them a
  higher role in that project's **Settings → Access**. A project role can
  raise access, never lower it.
* **Only admins edit policies:** on **Settings → Security**, turn on
  **Only admins can edit policies** in the **Policy editing** card. Everyone
  can still read them.
* **Restrict where people sign in from:** the **IP Allowlist** card on the
  same page (needs IP allowlisting on your plan).

Detail: [Organizations and teams](https://docs.promptguard.co/platform/organizations.md),
[project-level access](https://docs.promptguard.co/platform/organizations.md#project-level-access),
[who can change policies](https://docs.promptguard.co/shadow-ai/customise-policies.md#who-can-change-policies).

## 3. Author the policy

Policy belongs to a project: each application, and your Shadow AI fleet, is
one. Open the project, then **Guardrails**. Lightest change first:

1. **Built-in Detectors** tab: pick a strictness level (**Strict**,
   **Moderate**, **Permissive**), then switch single checks on or off and
   choose which kinds of PII to catch.
   [Policy presets](https://docs.promptguard.co/security/policy-presets.md#strictness-levels).
2. **Warn before you block:** give Prompt Injection or Toxicity a warn
   threshold below its block threshold. Scores in between are allowed and
   recorded as flagged.
   [Warn and block thresholds](https://docs.promptguard.co/api-reference/guard.md#warn-and-block-thresholds).
3. **Policies** tab → **Create policy** for your own rules: a word list, a
   codename, an identifier, each with an action of block, redact, flag or
   allow. [Custom rules](https://docs.promptguard.co/security/custom-rules.md#rule-conditions).
4. **A boundary you can only describe** ("nothing about unreleased
   products"): a policy of type **LLM Guard** or **Topic Filter**, with the
   rule written as a sentence. It adds time and cost to every scan, so use a
   rule from step 3 when one will do.
   [LLM Guard](https://docs.promptguard.co/security/custom-rules.md#llm-guard).
5. **One false positive:** open the event and create a Suppression for that
   rule. [Suppressions](https://docs.promptguard.co/api-reference/guard.md#suppressions).

Steps 3 and 4 need custom policies on your plan. A saved change applies to
the next scan, and reaches every Shadow AI device within about a minute
([When a policy change takes effect](https://docs.promptguard.co/security/policy-changes.md)).
**Protect → Policies** lists every rule across all projects in one view.

Your engineers can keep the same policies in version control instead
([Policy-as-code](https://docs.promptguard.co/security/policy-as-code.md)); that route needs code, this one
does not.

## 4. Decide what is kept

* **Organization-wide retention:** **Settings → Data Retention** sets how many
  days request logs and security events are kept (needs custom retention on
  your plan; otherwise your plan's default applies).
* **Per project:** **Zero retention** in the project's **Settings → Data**
  stores no content preview at all for that project.

Detail: [Data handling](https://docs.promptguard.co/security/compliance.md#data-handling),
[Shadow AI retention](https://docs.promptguard.co/shadow-ai/privacy-data-handling.md#retention).

## 5. Route alerts

An alert is a request that was blocked or flagged, or detected with high
confidence ([which events alert](https://docs.promptguard.co/integrations/siem-export.md#which-events-raise-an-alert)).

* **Email:** **Settings → Notifications**. Choose **All Alerts**,
  **Critical Only** or **Disabled**, and turn **Threat Alerts** on. This is
  per person: each admin sets their own.
* **Slack, PagerDuty, Datadog, Splunk or any HTTPS endpoint:** open the
  project → **Settings** → **Alert delivery**, and add a destination on the
  **Alert destinations** card, choosing its format. Each project routes its
  own alerts, so add destinations to every project that matters, including
  your Shadow AI fleet project. Every attempt is in the project's delivery
  log.
* **In the dashboard:** **Monitor → Alerts** lists anomalies across all
  projects.

Webhook destinations need webhook alerts on your plan. Detail:
[Webhooks](https://docs.promptguard.co/platform/webhooks.md), [SIEM export](https://docs.promptguard.co/integrations/siem-export.md).

## 6. Send events to your SIEM

Two routes carry the same record; use both if you can.

* **Push:** an alert destination from step 5 in the **Splunk HEC** or generic
  JSON format, or a Microsoft Sentinel Logic App URL. Your SIEM verifies each
  delivery's signature.
* **Pull:** **Connect → API Keys** → create a key and choose the kind
  **SIEM export: read-only**. Only admins are offered it. Your collector uses
  it to read every event, or only alerts, across the organization, and to
  backfill anything a push missed. Your SIEM team configures the collector;
  you only make the key.

Detail: [SIEM export](https://docs.promptguard.co/integrations/siem-export.md) (Splunk, Sentinel, the event
fields, and [pulling with an export key](https://docs.promptguard.co/integrations/siem-export.md#pull-with-an-export-key)).

## 7. Review the audit log

**Organization → Audit Log** records who changed what and when: sign-ins,
member and role changes, API keys created, deleted or rate-limited,
Suppressions, and other configuration changes. Filter by category,
action, severity, actor and date, and export it for an auditor. Admins see
every event in the organization; other members see only their own.

What each request was decided is a different record: the project's
**Interactions** page, and **Monitor → Activity** across projects.

Needs audit logs on your plan. Detail: [Audit logs](https://docs.promptguard.co/platform/audit-logs.md),
including how to verify the log's integrity chain.

## Prove it works

Before you sign off, run the evaluation for what you are protecting. Each has
pass/fail criteria and ends with a production-readiness checklist.

> [card] [Evaluate Shadow AI](https://docs.promptguard.co/guides/evaluate-shadow-ai.md)
>
> One test device: a secret stopped, the event in your dashboard, a policy
> change timed.

> [card] [Evaluate as a developer](https://docs.promptguard.co/guides/evaluate-developer.md)
>
> For an application: a block, a redaction and a flag, each checked in the
> dashboard. Hand it to your engineers.

## Next steps

> [card] [SIEM export](https://docs.promptguard.co/integrations/siem-export.md)
>
> Send every alert to your SIEM, signed

> [card] [Fleet enrollment](https://docs.promptguard.co/shadow-ai/fleet-enrollment.md)
>
> Roll Shadow AI out to every device

> [card] [Policy as code](https://docs.promptguard.co/security/policy-as-code.md)
>
> Guardrails in YAML, managed with git


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.