Signed in asM. HalloranCompliance officer · Compliance/BSAThe console in full: every actor, every event, the adjudication queue, and the actions on the pending policy proposal.
Provenance · one movement, end to end
H. Delacroix — paste to M365 Copilot
Jul 30, 2026 at 3:43 PM · Week 8 · event 87baefac-7015-457c-a1fd-63c7329909c9Actor
H. Delacroix — Credit analyst, Credit Administration · Credit role groupThe role group is what the policy engine resolves against; the department is what the console cuts by. The event carries both, so no projection has to join.
Content
Draft a birthday message for Hassan Achterberg, date of birth 1965-03-04, who has banked with us for eleven years.
proved by a checksum or a format rule · matched by a pattern, which is a shape, or by the taxonomy or the institution’s dictionary, which are vocabulary markers — neither is a proof
| Data class | Offsets | Proof | Detector |
|---|---|---|---|
| Member PII | 29–46 | pattern match — a shape, not a proof | cmb-member-pii |
One span here is seeded, not re-derived. 29–46 — the name is proven at that offset by the engine’s own name rule, and the identifier pairing that makes it Member PII is seeded rather than re-derived: this excerpt carries no identifier for the combination rule to pair with. The span is counted in every figure on this console; what it is not is a chain an examiner can replay end to end, which is why the evidence package prints only chains that reproduce exactly.
Decision
Warn under policy v4, in force from Jul 20, 2026.The cells that decided it, for the Credit role group: Member PII — Warn.
Transform
Redact · 1 span(s) masked, 0 replaced by a format-preserving token.Re-derived here from the stored spans, not read from a stored copy — a redaction that cannot be reproduced from the record is a redaction an examiner cannot check.
Draft a birthday message for █████████████████, date of birth 1965-03-04, who has banked with us for eleven years.
Destination
M365 Copilot — enterprise, sanctionedThe enterprise tenant, allow-listed per data class — sanctioned is not the same as unrestricted.
Member PIIallowedPermitted; the tenant is contracted and in scope for the institution’s information security program.
Outcome
The user transformed after the card.Triage marked it true positive — Y. Abadi, Jul 30, 2026 at 5:30 PM. Open in Triage
The record
- captured Jul 30, 2026 at 3:43 PMH. Delacroix (Credit analyst, Credit Administration) — paste to M365 Copilot.
- classified Jul 30, 2026 at 3:43 PM1 span in member_pii; proof recorded on each span.
- decided Jul 30, 2026 at 3:43 PMwarn under policy v4, from the member_pii cell for the credit role group.
- transformed Jul 30, 2026 at 3:43 PMSafe transform taken on the coach card: 1 span(s) masked in place by offset. Warn does not rewrite anything by itself — the person chose this. The tokenize option is not on for the account_numbers cell in the credit role group under v4, so every span is masked.
- submitted Jul 30, 2026 at 3:43 PMSubmitted to M365 Copilot after transformation; the original text was not sent.
- adjudicated Jul 30, 2026 at 5:30 PMMarked a true positive by Y. Abadi in triage.
The same chain in JSON: /api/v1/events?id=87baefac…
Events · the log itself
1,144 events matching trailing 30 days
Jul 16 – Aug 14, 2026. Every row drills to the full provenance chain, and every state on this page — filters, page and drill alike — is a URL you can paste to a colleague. The same query as JSON: /api/v1/events?scope=windowWho sent them — 24 people across 1,144 events
N. OyelaranCredit Administration138H. DelacroixCredit Administration137A. BergströmCredit Administration119K. OseiCommercial Lending78D. WhitfieldCommercial Lending76R. OkaforCommercial Lending75I. QuinteroRetail & Branch Ops72T. BeaulieuCommercial Lending70
The 8 people carrying the most of this filter, of 24. Narrow the Person control above to read one of them alone.
| When | Who | Channel · destination | Classes | Decision | Outcome | |
|---|---|---|---|---|---|---|
| Jul 31, 2026 at 9:05 AMWeek 8 | A. BergströmCredit Administration | uploadChatGPT (personal) | Loan Files, Member PII | Warnv4 | transformed | Chain |
| Jul 31, 2026 at 8:48 AMWeek 8 | L. TranRetail & Branch Ops | promptChatGPT (personal) | Member PII | Monitorv4 | —true positive | Chain |
| Jul 31, 2026 at 8:46 AMWeek 8 | L. TranRetail & Branch Ops | promptM365 Copilot | Member PII | Monitorv4 | — | Chain |
| Jul 31, 2026 at 8:46 AMWeek 8 | S. AdeyemiRetail & Branch Ops | promptChatGPT (personal) | Account Numbers, Member PII | Monitorv4 | — | Chain |
| Jul 31, 2026 at 8:21 AMWeek 8 | A. BergströmCredit Administration | promptChatGPT (personal) | Member PII, Account Numbers | Warnv4 | redirected | Chain |
| Jul 31, 2026 at 8:07 AMWeek 8 | R. OkaforCommercial Lending | promptClaude.ai (personal) | Credit Memos, Member PII | Warnv4 | overridden | Chain |
| Jul 31, 2026 at 8:07 AMWeek 8 | L. TranRetail & Branch Ops | promptGemini Advanced | Member PII, Account Numbers | Monitorv4 | — | Chain |
| Jul 31, 2026 at 8:04 AMWeek 8 | T. BeaulieuCommercial Lending | promptGemini Advanced | Account Numbers | Monitorv4 | — | Chain |
| Jul 30, 2026 at 5:33 PMWeek 8 | N. OyelaranCredit Administration | uploadMicrosoft Copilot (consumer) | Credit Memos, Member PII | Warnv4 | abandoned | Chain |
| Jul 30, 2026 at 5:23 PMWeek 8 | S. AdeyemiRetail & Branch Ops | pasteM365 Copilot | Account Numbers | Monitorv4 | — | Chain |
| Jul 30, 2026 at 5:19 PMWeek 8 | H. DelacroixCredit Administration | pasteClaude.ai (personal) | Credit Memos, Member PII | Warnv4 | overridden | Chain |
| Jul 30, 2026 at 5:11 PMWeek 8 | M. RamaswamyCommercial Lending | pasteChatGPT (personal) | Loan Files, Member PII | Warnv4 | redirected | Chain |
| Jul 30, 2026 at 5:08 PMWeek 8 | J. KowalczykRetail & Branch Ops | pasteChatGPT (personal) | Account Numbers, Member PII | Monitorv4 | — | Chain |
| Jul 30, 2026 at 5:04 PMWeek 8 | A. BergströmCredit Administration | pasteChatGPT (personal) | Member PII, SSN / Tax ID, Account Numbers | Warnv4 | redirected | Chain |
| Jul 30, 2026 at 4:59 PMWeek 8 | T. BeaulieuCommercial Lending | pasteGemini Advanced | Loan Files, Member PII | Warnv4 | redirected | Chain |
| Jul 30, 2026 at 4:52 PMWeek 8 | H. DelacroixCredit Administration | pasteChatGPT (personal) | Credit Memos | Monitorv4 | — | Chain |
| Jul 30, 2026 at 4:24 PMWeek 8 | R. OkaforCommercial Lending | pasteClaude.ai (personal) | Member PII, SSN / Tax ID, Account Numbers | Warnv4 | abandoned | Chain |
| Jul 30, 2026 at 4:22 PMWeek 8 | P. NakamuraRetail & Branch Ops | promptChatGPT (personal) | Member PII | Monitorv4 | — | Chain |
| Jul 30, 2026 at 4:17 PMWeek 8 | A. BergströmCredit Administration | pasteChatGPT (personal) | Member PII, SSN / Tax ID, Account Numbers | Warnv4 | transformed | Chain |
| Jul 30, 2026 at 4:11 PMWeek 8 | R. CastellanoCompliance/BSA | promptM365 Copilot | Member PII | Monitorv4 | — | Chain |
| Jul 30, 2026 at 4:01 PMWeek 8 | A. BergströmCredit Administration | promptChatGPT (personal) | Member PII, Account Numbers | Warnv4 | redirected | Chain |
| Jul 30, 2026 at 3:54 PMWeek 8 | H. DelacroixCredit Administration | pasteMicrosoft Copilot (consumer) | Member PII | Warnv4 | transformed | Chain |
| Jul 30, 2026 at 3:43 PMWeek 8 | H. DelacroixCredit Administration | pasteM365 Copilot | Member PII | Warnv4 | transformedtrue positive | Chain |
| Jul 30, 2026 at 3:34 PMWeek 8 | K. OseiCommercial Lending | uploadMicrosoft Copilot (consumer) | Loan Files | Monitorv4 | — | Chain |
| Jul 30, 2026 at 3:31 PMWeek 8 | D. WhitfieldCommercial Lending | pasteChatGPT (personal) | Loan Files, Member PII | Warnv4 | transformed | Chain |
Showing 626–650 of 1,144 · page 26 of 46⇤ First← PreviousNext →Last ⇥