Signed in asM. HalloranCompliance officer · Compliance/BSAThe console in full: every actor, every event, the adjudication queue, and the actions on the pending policy proposal.
Provenance · one movement, end to end
F. Duarte — prompt to Gemini Advanced
Aug 10, 2026 at 5:10 PM · Week 10 · event 8685f28c-0603-41e9-8f12-d2cf373500c5Actor
F. Duarte — IT director, IT · IT role groupThe role group is what the policy engine resolves against; the department is what the console cuts by. The event carries both, so no projection has to join.
Content
Why does the nightly job fail with this credential set? AKIAQQAMA4AQYYAUQUAY has read access to the statements bucket.
proved by a checksum or a format rule · matched by a pattern, which is a shape, or by the taxonomy or the institution’s dictionary, which are vocabulary markers — neither is a proof
| Data class | Offsets | Proof | Detector |
|---|---|---|---|
| API Keys / Creds | 56–76 | pattern match — a shape, not a proof | pat-credential |
Decision
Block under policy v5, in force from Aug 3, 2026.The cells that decided it, for the IT role group: API Keys / Creds — Block.
Transform
No transform ran. The content was decided and left as it was.
Destination
Gemini Advanced — public, assessedReached most often through personal Google accounts on bank hardware.
Outcome
No coaching outcome: the mode did not put a card in front of anybody.Not adjudicated. The absence means something: precision is computed over the adjudicated sample only, and an unreviewed event is not evidence of anything.
The record
- captured Aug 10, 2026 at 5:10 PMF. Duarte (IT director, IT) — prompt to Gemini Advanced.
- classified Aug 10, 2026 at 5:10 PM1 span in api_keys_creds; proof recorded on each span.
- decided Aug 10, 2026 at 5:10 PMblock under policy v5, from the api_keys_creds cell for the it role group.
- blocked Aug 10, 2026 at 5:10 PMSubmission stopped before it left the browser. Nothing reached Gemini Advanced.
The same chain in JSON: /api/v1/events?id=8685f28c…
Events · the log itself
34 events matching blocked in the page · trailing 30 days
Jul 16 – Aug 14, 2026. Every row drills to the full provenance chain, and every state on this page — filters, page and drill alike — is a URL you can paste to a colleague. The same query as JSON: /api/v1/events?scope=window&split=blockedWho sent them — 7 people across 34 events
| When | Who | Channel · destination | Classes | Decision | Outcome | |
|---|---|---|---|---|---|---|
| Aug 14, 2026 at 3:29 PMWeek 10 | V. SokolovIT | promptChatGPT (personal) | API Keys / Creds | Blockv5 | —true positive | Chain |
| Aug 14, 2026 at 1:42 PMWeek 10 | F. DuarteIT | promptClaude.ai (personal) | API Keys / Creds | Blockv5 | — | Chain |
| Aug 14, 2026 at 12:06 PMWeek 10 | B. MwangiFinance | pasteChatGPT (personal) | API Keys / Creds | Blockv5 | — | Chain |
| Aug 13, 2026 at 5:36 PMWeek 10 | L. TranRetail & Branch Ops | promptGemini Advanced | API Keys / Creds | Blockv5 | — | Chain |
| Aug 13, 2026 at 2:05 PMWeek 10 | V. SokolovIT | pasteChatGPT (personal) | API Keys / Creds | Blockv5 | — | Chain |
| Aug 13, 2026 at 8:20 AMWeek 10 | F. DuarteIT | pasteClaude.ai (personal) | API Keys / Creds | Blockv5 | — | Chain |
| Aug 12, 2026 at 5:07 PMWeek 10 | V. SokolovIT | promptChatGPT (personal) | API Keys / Creds | Blockv5 | — | Chain |
| Aug 12, 2026 at 3:18 PMWeek 10 | F. DuarteIT | promptChatGPT (personal) | API Keys / Creds | Blockv5 | — | Chain |
| Aug 12, 2026 at 2:30 PMWeek 10 | G. IyerIT | pasteMicrosoft Copilot (consumer) | API Keys / Creds | Blockv5 | — | Chain |
| Aug 11, 2026 at 3:58 PMWeek 10 | G. IyerIT | promptChatGPT (personal) | API Keys / Creds | Blockv5 | — | Chain |
| Aug 11, 2026 at 3:05 PMWeek 10 | F. DuarteIT | uploadClaude.ai (personal) | Confidential Supervisory Information | Blockv5 | — | Chain |
| Aug 11, 2026 at 2:10 PMWeek 10 | V. SokolovIT | pasteMicrosoft Copilot (consumer) | API Keys / Creds | Blockv5 | — | Chain |
| Aug 10, 2026 at 5:10 PMWeek 10 | F. DuarteIT | promptGemini Advanced | API Keys / Creds | Blockv5 | — | Chain |
| Aug 10, 2026 at 4:06 PMWeek 10 | F. DuarteIT | pasteChatGPT (personal) | API Keys / Creds | Blockv5 | — | Chain |
| Aug 7, 2026 at 9:57 AMWeek 9 | V. SokolovIT | promptClaude.ai (personal) | API Keys / Creds | Blockv5 | — | Chain |
| Aug 7, 2026 at 8:37 AMWeek 9 | F. DuarteIT | pastePerplexity | API Keys / Creds | Blockv5 | — | Chain |
| Aug 6, 2026 at 1:28 PMWeek 9 | G. IyerIT | promptMicrosoft Copilot (consumer) | API Keys / Creds | Blockv5 | — | Chain |
| Aug 6, 2026 at 12:32 PMWeek 9 | F. DuarteIT | pasteMicrosoft Copilot (consumer) | API Keys / Creds | Blockv5 | — | Chain |
| Aug 6, 2026 at 9:15 AMWeek 9 | I. QuinteroRetail & Branch Ops | pasteGemini Advanced | BSA / AML Material | Blockv5 | — | Chain |
| Aug 5, 2026 at 1:52 PMWeek 9 | V. SokolovIT | promptChatGPT (personal) | API Keys / Creds | Blockv5 | — | Chain |
| Aug 5, 2026 at 8:42 AMWeek 9 | G. IyerIT | pasteChatGPT (personal) | API Keys / Creds | Blockv5 | — | Chain |
| Aug 4, 2026 at 2:28 PMWeek 9 | G. IyerIT | pasteMicrosoft Copilot (consumer) | API Keys / Creds | Blockv5 | — | Chain |
| Aug 4, 2026 at 9:24 AMWeek 9 | G. IyerIT | promptClaude.ai (personal) | API Keys / Creds | Blockv5 | — | Chain |
| Aug 3, 2026 at 4:03 PMWeek 9 | V. SokolovIT | pasteChatGPT (personal) | API Keys / Creds | Blockv5 | —true positive | Chain |
| Jul 31, 2026 at 4:01 PMWeek 8 | F. DuarteIT | pasteChatGPT (personal) | API Keys / Creds | Blockv4 | — | Chain |