Signed in asExamination teamExaminer — read-only · ExaminationRead-only evidence. Every figure is the figure the institution reads; what is absent is the ability to change anything — no adjudication, no rung moved, no proposal advanced.
Provenance · one movement, end to end
K. Osei — paste to M365 Copilot
Jul 22, 2026 at 9:25 AM · Week 7 · event 891d42c2-3ce2-42ca-830d-c1a9b8e43376Actor
K. Osei — Portfolio manager, Commercial Lending · Lending role groupThe role group is what the policy engine resolves against; the department is what the console cuts by. The event carries both, so no projection has to join.
Content
Confirm the wire instructions for Jamal Villareal — routing 042990961, account 00114945. Draft the callback script.
proved by a checksum or a format rule · matched by a pattern, which is a shape, or by the taxonomy or the institution’s dictionary, which are vocabulary markers — neither is a proof
| Data class | Offsets | Proof | Detector |
|---|---|---|---|
| Member PII | 34–49 | pattern match — a shape, not a proof | cmb-member-pii |
| Account Numbers | 60–69 | ABA routing checksum | val-aba |
| Account Numbers | 79–87 | pattern match — a shape, not a proof | pat-account |
Decision
Warn under policy v4, in force from Jul 20, 2026.The cells that decided it, for the Lending role group: Member PII — Warn; Account Numbers — Monitor.
Transform
Redact · 3 span(s) masked, 0 replaced by a format-preserving token.Re-derived here from the stored spans, not read from a stored copy — a redaction that cannot be reproduced from the record is a redaction an examiner cannot check.
Confirm the wire instructions for ███████████████ — routing █████████, account ████████. Draft the callback script.
Destination
M365 Copilot — enterprise, sanctionedThe enterprise tenant, allow-listed per data class — sanctioned is not the same as unrestricted.
Member PIIallowedPermitted; the tenant is contracted and in scope for the institution’s information security program.Account NumbersallowedPermitted; tokenized wherever the grid says tokenize — format preserved, value substituted.
Outcome
The user transformed after the card.Triage marked it true positive — Y. Abadi, Jul 22, 2026 at 5:30 PM. Open in Triage
The record
- captured Jul 22, 2026 at 9:25 AMK. Osei (Portfolio manager, Commercial Lending) — paste to M365 Copilot.
- classified Jul 22, 2026 at 9:25 AM3 spans in member_pii, account_numbers; proof recorded on each span.
- decided Jul 22, 2026 at 9:25 AMwarn under policy v4, from the member_pii cell for the lending role group.
- transformed Jul 22, 2026 at 9:25 AMSafe transform taken on the coach card: 3 span(s) masked in place by offset. Warn does not rewrite anything by itself — the person chose this. The tokenize option is not on for the account_numbers cell in the lending role group under v4, so every span is masked.
- submitted Jul 22, 2026 at 9:25 AMSubmitted to M365 Copilot after transformation; the original text was not sent.
- adjudicated Jul 22, 2026 at 5:30 PMMarked a true positive by Y. Abadi in triage.
The same chain in JSON: /api/v1/events?id=891d42c2…
Events · the log itself
2,182 events across the pilot
Jun 8 – Aug 14, 2026. Every row drills to the full provenance chain, and every state on this page — filters, page and drill alike — is a URL you can paste to a colleague. The same query as JSON: /api/v1/events?as=examinerWho sent them — 24 people across 2,182 events
N. OyelaranCredit Administration243A. BergströmCredit Administration242H. DelacroixCredit Administration240D. WhitfieldCommercial Lending148M. RamaswamyCommercial Lending138R. OkaforCommercial Lending136J. KowalczykRetail & Branch Ops135K. OseiCommercial Lending134
The 8 people carrying the most of this filter, of 24. Narrow the Person control above to read one of them alone.
| When | Who | Channel · destination | Classes | Decision | Outcome | |
|---|---|---|---|---|---|---|
| Aug 14, 2026 at 5:41 PMWeek 10 | B. MwangiFinance | pasteGemini Advanced | Member PII, Account Numbers | Monitorv5 | — | Chain |
| Aug 14, 2026 at 5:21 PMWeek 10 | A. BergströmCredit Administration | uploadClaude.ai (personal) | Credit Memos, Member PII | Warnv5 | transformed | Chain |
| Aug 14, 2026 at 4:35 PMWeek 10 | J. KowalczykRetail & Branch Ops | promptClaude.ai (personal) | Account Numbers | Monitorv5 | — | Chain |
| Aug 14, 2026 at 4:34 PMWeek 10 | T. BeaulieuCommercial Lending | uploadClaude.ai (personal) | Credit Memos, Member PII | Redactv5 | — | Chain |
| Aug 14, 2026 at 4:28 PMWeek 10 | I. QuinteroRetail & Branch Ops | promptPerplexity | Account Numbers | Monitorv5 | — | Chain |
| Aug 14, 2026 at 4:26 PMWeek 10 | A. BergströmCredit Administration | promptChatGPT (personal) | Account Numbers, Member PII | Warnv5 | overridden | Chain |
| Aug 14, 2026 at 4:08 PMWeek 10 | B. MwangiFinance | promptClaude.ai (personal) | Account Numbers | Monitorv5 | — | Chain |
| Aug 14, 2026 at 3:46 PMWeek 10 | N. OyelaranCredit Administration | pasteClaude.ai (personal) | Member PII | Warnv5 | redirected | Chain |
| Aug 14, 2026 at 3:42 PMWeek 10 | T. BeaulieuCommercial Lending | pasteChatGPT (personal) | Loan Files, Member PII | Redactv5 | — | Chain |
| Aug 14, 2026 at 3:32 PMWeek 10 | R. OkaforCommercial Lending | pasteMicrosoft Copilot (consumer) | Member PII | Redactv5 | — | Chain |
| Aug 14, 2026 at 3:29 PMWeek 10 | N. OyelaranCredit Administration | uploadGemini Advanced | Credit Memos, Member PII | Warnv5 | abandoned | Chain |
| Aug 14, 2026 at 3:29 PMWeek 10 | V. SokolovIT | promptChatGPT (personal) | API Keys / Creds | Blockv5 | —true positive | Chain |
| Aug 14, 2026 at 3:24 PMWeek 10 | B. MwangiFinance | pasteChatGPT (personal) | Account Numbers | Monitorv5 | — | Chain |
| Aug 14, 2026 at 3:23 PMWeek 10 | K. OseiCommercial Lending | uploadClaude.ai (personal) | Loan Files | Monitorv5 | — | Chain |
| Aug 14, 2026 at 3:15 PMWeek 10 | P. NakamuraRetail & Branch Ops | pasteChatGPT (personal) | Account Numbers, Member PII | Monitorv5 | — | Chain |
| Aug 14, 2026 at 3:12 PMWeek 10 | H. DelacroixCredit Administration | uploadPerplexity | Credit Memos, Member PII | Warnv5 | overridden | Chain |
| Aug 14, 2026 at 3:05 PMWeek 10 | M. RamaswamyCommercial Lending | promptChatGPT (personal) | Loan Files, Member PII | Redactv5 | — | Chain |
| Aug 14, 2026 at 2:54 PMWeek 10 | M. RamaswamyCommercial Lending | uploadClaude.ai (personal) | Loan Files, Member PII | Redactv5 | — | Chain |
| Aug 14, 2026 at 2:48 PMWeek 10 | A. BergströmCredit Administration | promptGemini Advanced | Member PII | Warnv5 | transformed | Chain |
| Aug 14, 2026 at 2:26 PMWeek 10 | A. BergströmCredit Administration | pasteChatGPT (personal) | Credit Memos, Member PII | Warnv5 | redirected | Chain |
| Aug 14, 2026 at 2:16 PMWeek 10 | K. OseiCommercial Lending | promptGemini Advanced | Credit Memos, Member PII | Redactv5 | — | Chain |
| Aug 14, 2026 at 2:14 PMWeek 10 | S. AdeyemiRetail & Branch Ops | promptChatGPT (personal) | Member PII, Account Numbers | Monitorv5 | —true positive | Chain |
| Aug 14, 2026 at 1:57 PMWeek 10 | T. BeaulieuCommercial Lending | promptChatGPT (personal) | Loan Files, Member PII | Redactv5 | —true positive | Chain |
| Aug 14, 2026 at 1:52 PMWeek 10 | R. OkaforCommercial Lending | promptChatGPT (personal) | Loan Files, Member PII | Redactv5 | — | Chain |
| Aug 14, 2026 at 1:42 PMWeek 10 | F. DuarteIT | promptClaude.ai (personal) | API Keys / Creds | Blockv5 | — | Chain |