Signed in asM. HalloranCompliance officer · Compliance/BSAThe console in full: every actor, every event, the adjudication queue, and the actions on the pending policy proposal.
Provenance · one movement, end to end
S. Adeyemi — prompt to M365 Copilot
Aug 10, 2026 at 8:24 AM · Week 10 · event 52ac15ad-e765-4245-9b3d-ddf53b23710cActor
S. Adeyemi — Customer service representative, Retail & Branch Ops · Operations role groupThe role group is what the policy engine resolves against; the department is what the console cuts by. The event carries both, so no projection has to join.
Content
The card ending in this number keeps declining: 4539807815502596. The customer is Greta Kovalenko. What should the branch check first?
proved by a checksum or a format rule · matched by a pattern, which is a shape, or by the taxonomy or the institution’s dictionary, which are vocabulary markers — neither is a proof
| Data class | Offsets | Proof | Detector |
|---|---|---|---|
| Account Numbers | 48–64 | Luhn checksum | val-luhn |
| Member PII | 82–97 | pattern match — a shape, not a proof | cmb-member-pii |
Decision
Monitor under policy v5, in force from Aug 3, 2026.The cells that decided it, for the Operations role group: Account Numbers — Monitor; Member PII — Monitor.
Transform
No transform ran. The content was decided and left as it was.
Destination
M365 Copilot — enterprise, sanctionedThe enterprise tenant, allow-listed per data class — sanctioned is not the same as unrestricted.
Account NumbersallowedPermitted; tokenized wherever the grid says tokenize — format preserved, value substituted.Member PIIallowedPermitted; the tenant is contracted and in scope for the institution’s information security program.
Outcome
No coaching outcome: the mode did not put a card in front of anybody.Triage marked it true positive — M. Halloran, Aug 10, 2026 at 5:30 PM. Open in Triage
The record
- captured Aug 10, 2026 at 8:24 AMS. Adeyemi (Customer service representative, Retail & Branch Ops) — prompt to M365 Copilot.
- classified Aug 10, 2026 at 8:24 AM2 spans in account_numbers, member_pii; proof recorded on each span.
- decided Aug 10, 2026 at 8:24 AMmonitor under policy v5, from the account_numbers cell for the operations role group.
- submitted Aug 10, 2026 at 8:24 AMSubmitted to M365 Copilot as typed.
- adjudicated Aug 10, 2026 at 5:30 PMMarked a true positive by M. Halloran in triage.
The same chain in JSON: /api/v1/events?id=52ac15ad…
Events · the log itself
73 events matching M365 Copilot · trailing 30 days
Jul 16 – Aug 14, 2026. Every row drills to the full provenance chain, and every state on this page — filters, page and drill alike — is a URL you can paste to a colleague. The same query as JSON: /api/v1/events?tool=m365-copilot&scope=windowWho sent them — 17 people across 73 events
H. DelacroixCredit Administration10N. OyelaranCredit Administration9K. OseiCommercial Lending8A. BergströmCredit Administration7M. RamaswamyCommercial Lending6D. WhitfieldCommercial Lending5L. TranRetail & Branch Ops5E. LindqvistFinance3
The 8 people carrying the most of this filter, of 17. Narrow the Person control above to read one of them alone.
| When | Who | Channel · destination | Classes | Decision | Outcome | |
|---|---|---|---|---|---|---|
| Aug 14, 2026 at 10:29 AMWeek 10 | A. BergströmCredit Administration | pasteM365 Copilot | Loan Files, Member PII | Warnv5 | abandonedtrue positive | Chain |
| Aug 13, 2026 at 2:35 PMWeek 10 | D. WhitfieldCommercial Lending | pasteM365 Copilot | Member PII, SSN / Tax ID, Account Numbers | Redactv5 | — | Chain |
| Aug 13, 2026 at 2:30 PMWeek 10 | N. OyelaranCredit Administration | uploadM365 Copilot | Loan Files, Member PII | Warnv5 | transformed | Chain |
| Aug 12, 2026 at 3:41 PMWeek 10 | B. MwangiFinance | pasteM365 Copilot | Account Numbers, Member PII | Monitorv5 | — | Chain |
| Aug 12, 2026 at 2:33 PMWeek 10 | H. DelacroixCredit Administration | uploadM365 Copilot | Member PII, Account Numbers, SSN / Tax ID, Loan Files | Warnv5 | transformed | Chain |
| Aug 12, 2026 at 2:18 PMWeek 10 | N. OyelaranCredit Administration | pasteM365 Copilot | Credit Memos, Member PII | Warnv5 | redirected | Chain |
| Aug 12, 2026 at 10:53 AMWeek 10 | H. DelacroixCredit Administration | promptM365 Copilot | Loan Files, Member PII | Warnv5 | overridden | Chain |
| Aug 12, 2026 at 10:50 AMWeek 10 | N. OyelaranCredit Administration | promptM365 Copilot | Loan Files, Member PII | Warnv5 | transformedtrue positive | Chain |
| Aug 12, 2026 at 10:06 AMWeek 10 | K. OseiCommercial Lending | uploadM365 Copilot | Credit Memos, Member PII | Redactv5 | — | Chain |
| Aug 12, 2026 at 9:23 AMWeek 10 | H. DelacroixCredit Administration | pasteM365 Copilot | Credit Memos, Member PII | Warnv5 | redirected | Chain |
| Aug 12, 2026 at 8:41 AMWeek 10 | H. DelacroixCredit Administration | promptM365 Copilot | Loan Files, Member PII | Warnv5 | redirected | Chain |
| Aug 11, 2026 at 5:39 PMWeek 10 | R. OkaforCommercial Lending | pasteM365 Copilot | Loan Files, Member PII | Redactv5 | — | Chain |
| Aug 11, 2026 at 4:21 PMWeek 10 | P. NakamuraRetail & Branch Ops | promptM365 Copilot | Member PII, Account Numbers | Monitorv5 | — | Chain |
| Aug 11, 2026 at 11:09 AMWeek 10 | I. QuinteroRetail & Branch Ops | pasteM365 Copilot | Account Numbers | Monitorv5 | — | Chain |
| Aug 10, 2026 at 5:43 PMWeek 10 | K. OseiCommercial Lending | pasteM365 Copilot | Loan Files, Member PII | Redactv5 | — | Chain |
| Aug 10, 2026 at 8:24 AMWeek 10 | S. AdeyemiRetail & Branch Ops | promptM365 Copilot | Account Numbers, Member PII | Monitorv5 | —true positive | Chain |
| Aug 7, 2026 at 5:18 PMWeek 9 | R. OkaforCommercial Lending | pasteM365 Copilot | Member PII | Redactv5 | — | Chain |
| Aug 7, 2026 at 4:37 PMWeek 9 | N. OyelaranCredit Administration | pasteM365 Copilot | Loan Files, Member PII | Warnv5 | redirected | Chain |
| Aug 7, 2026 at 9:43 AMWeek 9 | K. OseiCommercial Lending | pasteM365 Copilot | Account Numbers | Tokenizev5 | — | Chain |
| Aug 6, 2026 at 5:48 PMWeek 9 | M. RamaswamyCommercial Lending | uploadM365 Copilot | Loan Files, Member PII | Redactv5 | — | Chain |
| Aug 6, 2026 at 4:58 PMWeek 9 | S. AdeyemiRetail & Branch Ops | promptM365 Copilot | Member PII | Monitorv5 | — | Chain |
| Aug 6, 2026 at 12:07 PMWeek 9 | H. DelacroixCredit Administration | promptM365 Copilot | Member PII, Account Numbers | Warnv5 | redirected | Chain |
| Aug 6, 2026 at 10:29 AMWeek 9 | N. OyelaranCredit Administration | promptM365 Copilot | Credit Memos, Member PII | Warnv5 | redirected | Chain |
| Aug 6, 2026 at 10:19 AMWeek 9 | M. RamaswamyCommercial Lending | uploadM365 Copilot | Loan Files, Member PII | Redactv5 | — | Chain |
| Aug 5, 2026 at 5:01 PMWeek 9 | D. WhitfieldCommercial Lending | uploadM365 Copilot | Loan Files, Member PII | Redactv5 | — | Chain |