Signed in asM. HalloranCompliance officer · Compliance/BSAThe console in full: every actor, every event, the adjudication queue, and the actions on the pending policy proposal.
Provenance · one movement, end to end
H. Delacroix — upload to M365 Copilot
Aug 12, 2026 at 2:33 PM · Week 10 · event 59b65c07-2a94-407c-9eaf-146a25d5adf7Actor
H. Delacroix — Credit analyst, Credit Administration · Credit role groupThe role group is what the policy engine resolves against; the department is what the console cuts by. The event carries both, so no projection has to join.
Content
Spreading the 2025 financials for this relationship. Borrower Naomi Okonjo and co-borrower Tomas Villareal; operating account 00447821, payroll account 00619043, sweep account 00733158; guarantor tax ID 604-18-2277; loan CL-2026-04481. Which line items belong in EBITDA and which are add-backs?
proved by a checksum or a format rule · matched by a pattern, which is a shape, or by the taxonomy or the institution’s dictionary, which are vocabulary markers — neither is a proof
| Data class | Offsets | Proof | Detector |
|---|---|---|---|
| Member PII | 62–74 | pattern match — a shape, not a proof | cmb-member-pii |
| Member PII | 91–106 | pattern match — a shape, not a proof | cmb-member-pii |
| Account Numbers | 126–134 | pattern match — a shape, not a proof | pat-account |
| Account Numbers | 152–160 | pattern match — a shape, not a proof | pat-account |
| Account Numbers | 176–184 | pattern match — a shape, not a proof | pat-account |
| SSN / Tax ID | 203–214 | SSN format rule | val-ssn |
| Loan Files | 221–234 | pattern match — a shape, not a proof | pat-loan |
Decision
Warn under policy v5, in force from Aug 3, 2026.The cells that decided it, for the Credit role group: Member PII — Warn; Account Numbers — Monitor; SSN / Tax ID — Warn; Loan Files — Monitor.
Transform
Redact · 7 span(s) masked, 0 replaced by a format-preserving token.Re-derived here from the stored spans, not read from a stored copy — a redaction that cannot be reproduced from the record is a redaction an examiner cannot check.
Spreading the 2025 financials for this relationship. Borrower ████████████ and co-borrower ███████████████; operating account ████████, payroll account ████████, sweep account ████████; guarantor tax ID ███████████; loan █████████████. Which line items belong in EBITDA and which are add-backs?
Destination
M365 Copilot — enterprise, sanctionedThe enterprise tenant, allow-listed per data class — sanctioned is not the same as unrestricted.
Member PIIallowedPermitted; the tenant is contracted and in scope for the institution’s information security program.Account NumbersallowedPermitted; tokenized wherever the grid says tokenize — format preserved, value substituted.SSN / Tax IDrefusedRefused as typed. No business case has been recorded for a tax identifier in a chat surface; a masked one carries no identifier.Loan FilesallowedPermitted; the tenant is in scope for the institution’s information security program.
SSN / Tax ID would have been refused here, and left in masked form. The transform is what made this submission allowable — which is the argument for preview-and-confirm over a flat block, stated as a fact about one event rather than as a benefit in a deck.Outcome
The user transformed after the card.Not adjudicated. The absence means something: precision is computed over the adjudicated sample only, and an unreviewed event is not evidence of anything.
The record
- captured Aug 12, 2026 at 2:33 PMH. Delacroix (Credit analyst, Credit Administration) — upload to M365 Copilot.
- classified Aug 12, 2026 at 2:33 PM7 spans in member_pii, account_numbers, ssn_tax_id, loan_files; proof recorded on each span.
- decided Aug 12, 2026 at 2:33 PMwarn under policy v5, from the member_pii cell for the credit role group.
- transformed Aug 12, 2026 at 2:33 PMSafe transform taken on the coach card: 7 span(s) masked in place by offset. Warn does not rewrite anything by itself — the person chose this. The tokenize option is not on for the account_numbers cell in the credit role group under v5, so every span is masked.
- submitted Aug 12, 2026 at 2:33 PMSubmitted to M365 Copilot after transformation; the original text was not sent.
The same chain in JSON: /api/v1/events?id=59b65c07…
Events · the log itself
34 events matching blocked in the page · trailing 30 days
Jul 16 – Aug 14, 2026. Every row drills to the full provenance chain, and every state on this page — filters, page and drill alike — is a URL you can paste to a colleague. The same query as JSON: /api/v1/events?scope=window&split=blockedWho sent them — 7 people across 34 events
| When | Who | Channel · destination | Classes | Decision | Outcome | |
|---|---|---|---|---|---|---|
| Aug 14, 2026 at 3:29 PMWeek 10 | V. SokolovIT | promptChatGPT (personal) | API Keys / Creds | Blockv5 | —true positive | Chain |
| Aug 14, 2026 at 1:42 PMWeek 10 | F. DuarteIT | promptClaude.ai (personal) | API Keys / Creds | Blockv5 | — | Chain |
| Aug 14, 2026 at 12:06 PMWeek 10 | B. MwangiFinance | pasteChatGPT (personal) | API Keys / Creds | Blockv5 | — | Chain |
| Aug 13, 2026 at 5:36 PMWeek 10 | L. TranRetail & Branch Ops | promptGemini Advanced | API Keys / Creds | Blockv5 | — | Chain |
| Aug 13, 2026 at 2:05 PMWeek 10 | V. SokolovIT | pasteChatGPT (personal) | API Keys / Creds | Blockv5 | — | Chain |
| Aug 13, 2026 at 8:20 AMWeek 10 | F. DuarteIT | pasteClaude.ai (personal) | API Keys / Creds | Blockv5 | — | Chain |
| Aug 12, 2026 at 5:07 PMWeek 10 | V. SokolovIT | promptChatGPT (personal) | API Keys / Creds | Blockv5 | — | Chain |
| Aug 12, 2026 at 3:18 PMWeek 10 | F. DuarteIT | promptChatGPT (personal) | API Keys / Creds | Blockv5 | — | Chain |
| Aug 12, 2026 at 2:30 PMWeek 10 | G. IyerIT | pasteMicrosoft Copilot (consumer) | API Keys / Creds | Blockv5 | — | Chain |
| Aug 11, 2026 at 3:58 PMWeek 10 | G. IyerIT | promptChatGPT (personal) | API Keys / Creds | Blockv5 | — | Chain |
| Aug 11, 2026 at 3:05 PMWeek 10 | F. DuarteIT | uploadClaude.ai (personal) | Confidential Supervisory Information | Blockv5 | — | Chain |
| Aug 11, 2026 at 2:10 PMWeek 10 | V. SokolovIT | pasteMicrosoft Copilot (consumer) | API Keys / Creds | Blockv5 | — | Chain |
| Aug 10, 2026 at 5:10 PMWeek 10 | F. DuarteIT | promptGemini Advanced | API Keys / Creds | Blockv5 | — | Chain |
| Aug 10, 2026 at 4:06 PMWeek 10 | F. DuarteIT | pasteChatGPT (personal) | API Keys / Creds | Blockv5 | — | Chain |
| Aug 7, 2026 at 9:57 AMWeek 9 | V. SokolovIT | promptClaude.ai (personal) | API Keys / Creds | Blockv5 | — | Chain |
| Aug 7, 2026 at 8:37 AMWeek 9 | F. DuarteIT | pastePerplexity | API Keys / Creds | Blockv5 | — | Chain |
| Aug 6, 2026 at 1:28 PMWeek 9 | G. IyerIT | promptMicrosoft Copilot (consumer) | API Keys / Creds | Blockv5 | — | Chain |
| Aug 6, 2026 at 12:32 PMWeek 9 | F. DuarteIT | pasteMicrosoft Copilot (consumer) | API Keys / Creds | Blockv5 | — | Chain |
| Aug 6, 2026 at 9:15 AMWeek 9 | I. QuinteroRetail & Branch Ops | pasteGemini Advanced | BSA / AML Material | Blockv5 | — | Chain |
| Aug 5, 2026 at 1:52 PMWeek 9 | V. SokolovIT | promptChatGPT (personal) | API Keys / Creds | Blockv5 | — | Chain |
| Aug 5, 2026 at 8:42 AMWeek 9 | G. IyerIT | pasteChatGPT (personal) | API Keys / Creds | Blockv5 | — | Chain |
| Aug 4, 2026 at 2:28 PMWeek 9 | G. IyerIT | pasteMicrosoft Copilot (consumer) | API Keys / Creds | Blockv5 | — | Chain |
| Aug 4, 2026 at 9:24 AMWeek 9 | G. IyerIT | promptClaude.ai (personal) | API Keys / Creds | Blockv5 | — | Chain |
| Aug 3, 2026 at 4:03 PMWeek 9 | V. SokolovIT | pasteChatGPT (personal) | API Keys / Creds | Blockv5 | —true positive | Chain |
| Jul 31, 2026 at 4:01 PMWeek 8 | F. DuarteIT | pasteChatGPT (personal) | API Keys / Creds | Blockv4 | — | Chain |