> ## Documentation Index
> Fetch the complete documentation index at: https://docs.promptguard.co/llms.txt
> Use this file to discover all available pages before exploring further.

# What Each Part of a Request Is Checked For

> A desktop AI app sends much more than the words someone typed. Here is what PromptGuard checks in each part, and why.

When someone sends a message from Claude Desktop, ChatGPT Desktop or another AI
app, the app doesn't send only that message. Every request also carries:

* the app's own instructions;
* the whole conversation so far;
* a description of every tool its connectors offer.

The [desktop agent](/shadow-ai/desktop-agent) passes all of it to PromptGuard. PromptGuard
checks each part for what can actually go wrong in that part, instead of
treating all of it as if the person had just typed it.

## The four parts

| Part | What it is | What PromptGuard checks it for | Can it be redacted? |
| - | - | - | - |
| **Current turn** | What's new since the AI last answered: the person's message, the results of any tools it ran, and the tool calls those results answer | Everything your policies cover: prompt injection, personal data, secrets, data exfiltration, your own rules | Yes |
| **Earlier turns** | The rest of the conversation, resent by the app with every request | Nothing in them blocks again: each was the current turn of an earlier request and was checked then. Personal data and credentials in them are redacted again, because the app resends the original, not the redacted copy | Yes, for personal data and credentials |
| **Instructions** | The app's own system prompt, including what it adds about the signed-in person, such as their name, saved memories or project instructions | Secrets only, such as an API key pasted into project instructions. A secret here **blocks** the request | No: blocked instead, because the app's instructions aren't the person's to edit |
| **Tool definitions** | The name, description and input schema of each tool the app's connectors offer the model | Tool poisoning: hidden instructions in a description, smuggled invisible characters, and the other checks of the [MCP manifest scan](/security/mcp-security) | No: a poisoned tool **blocks** the request, and the reason names the tool |

## Why not check everything as if the person typed it?

Because the app's own text isn't the person's outbound message, and checking it
that way makes the protection unusable:

* **The app's instructions talk about instructions.** A system prompt that
  says "these system instructions describe how the assistant behaves" looks
  like a prompt injection to a rule that flags the phrase. Checked as the
  person's words, it blocked every request.
* **The person's own profile isn't a leak.** Claude Desktop tells the model
  the signed-in person's name. Redacting it rewrote the vendor's system prompt
  on every turn, and protected nothing.
* **One false positive shouldn't end a conversation.** The app resends the
  whole conversation each time. If earlier turns were checked again for what
  blocks, a message that tripped a rule once would block every message after
  it.

What is checked is checked fully. A key pasted anywhere the person controls is
caught: in the message itself, or in the project instructions and memory that
travel inside the app's instructions.

## Where you see it

Every finding on a Shadow AI request carries a `segment` that says which part
it came from: `current_turn`, `earlier_turn`, `instructions` or
`tool_definition`. You'll find it:

* on the event in your dashboard;
* in exported alerts;
* on the [Guard API](/api-reference/guard) response.

That lets your analysts tell a key someone typed apart from a key sitting in a
project's instructions, which need different fixes.

Earlier turns appear in the response's `unscanned` list with the reason
`earlier_turn`, because they are checked only for what to redact. "Allowed"
never claims more was read than actually was. A redaction in an earlier turn
is reported with segment `earlier_turn`.

## Agent versions

| Agent | Tool definitions | Tool calls |
| - | - | - |
| Up to v0.8.2 | Sent as part of the app's instructions, so they're checked for secrets but not yet for tool poisoning | Every turn's tool calls sent in one list, with nothing to say which turn made each, so all of them are checked as the current turn's |
| The release after v0.8.2 | Sent separately and checked as tool manifests | Sent with the turn that made them, so an earlier turn's calls are only redacted again, like its text |

Tools the AI provider runs itself, such as Gemini's Google Search or OpenAI's
web search, are offered by name only. There is nothing in them to check, so
they're not listed as unchecked.

Everything else on this page applies to every agent version, because the
checks run in PromptGuard, not on the device.

## What is not inspected

Some traffic never reaches these checks at all. For example:

* apps that pin their own certificates;
* traffic over QUIC/HTTP-3;
* messages an app sends over a WebSocket.

See [Known limitations](/shadow-ai/known-limitations).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.