Signed in asM. HalloranCompliance officer · Compliance/BSAThe console in full: every actor, every event, the adjudication queue, and the actions on the pending policy proposal.
Provenance · one movement, end to end
P. Nakamura — prompt to M365 Copilot
Jul 17, 2026 at 2:12 PM · Week 6 · event fd73b2bf-e66b-4d99-a78d-e83d873f0ac0Actor
P. Nakamura — Deposit operations analyst, Retail & Branch Ops · Operations role groupThe role group is what the policy engine resolves against; the department is what the console cuts by. The event carries both, so no projection has to join.
Content
Write a follow-up note to Astrid Toth at (419) 555-0105 about the certificate of deposit maturing next month.
proved by a checksum or a format rule · matched by a pattern, which is a shape, or by the taxonomy or the institution’s dictionary, which are vocabulary markers — neither is a proof
| Data class | Offsets | Proof | Detector |
|---|---|---|---|
| Member PII | 26–37 | pattern match — a shape, not a proof | cmb-member-pii |
One span here is seeded, not re-derived. 26–37 — the name is proven at that offset by the engine’s own name rule, and the identifier pairing that makes it Member PII is seeded rather than re-derived: this excerpt carries no identifier for the combination rule to pair with. The span is counted in every figure on this console; what it is not is a chain an examiner can replay end to end, which is why the evidence package prints only chains that reproduce exactly.
Decision
Monitor under policy v3, in force from Jul 13, 2026.The cells that decided it, for the Operations role group: Member PII — Monitor.
Transform
No transform ran. The content was decided and left as it was.
Destination
M365 Copilot — enterprise, sanctionedThe enterprise tenant, allow-listed per data class — sanctioned is not the same as unrestricted.
Member PIIallowedPermitted; the tenant is contracted and in scope for the institution’s information security program.
Outcome
No coaching outcome: the mode did not put a card in front of anybody.Triage marked it true positive — Y. Abadi, Jul 17, 2026 at 5:30 PM. Open in Triage
The record
- captured Jul 17, 2026 at 2:12 PMP. Nakamura (Deposit operations analyst, Retail & Branch Ops) — prompt to M365 Copilot.
- classified Jul 17, 2026 at 2:12 PM1 span in member_pii; proof recorded on each span.
- decided Jul 17, 2026 at 2:12 PMmonitor under policy v3, from the member_pii cell for the operations role group.
- submitted Jul 17, 2026 at 2:12 PMSubmitted to M365 Copilot as typed.
- adjudicated Jul 17, 2026 at 5:30 PMMarked a true positive by Y. Abadi in triage.
The same chain in JSON: /api/v1/events?id=fd73b2bf…
Events · the log itself
213 events matching policy v3
Jun 8 – Aug 14, 2026. Every row drills to the full provenance chain, and every state on this page — filters, page and drill alike — is a URL you can paste to a colleague. The same query as JSON: /api/v1/events?version=v3Who sent them — 20 people across 213 events
N. OyelaranCredit Administration24A. BergströmCredit Administration22H. DelacroixCredit Administration20J. KowalczykRetail & Branch Ops18I. QuinteroRetail & Branch Ops15K. OseiCommercial Lending15M. RamaswamyCommercial Lending15D. WhitfieldCommercial Lending14
The 8 people carrying the most of this filter, of 20. Narrow the Person control above to read one of them alone.
| When | Who | Channel · destination | Classes | Decision | Outcome | |
|---|---|---|---|---|---|---|
| Jul 17, 2026 at 5:57 PMWeek 6 | N. OyelaranCredit Administration | pasteChatGPT (personal) | Member PII | Warnv3 | transformedtrue positive | Chain |
| Jul 17, 2026 at 5:40 PMWeek 6 | H. DelacroixCredit Administration | uploadChatGPT (personal) | Credit Memos, Member PII | Warnv3 | transformed | Chain |
| Jul 17, 2026 at 5:29 PMWeek 6 | J. KowalczykRetail & Branch Ops | pasteMicrosoft Copilot (consumer) | Account Numbers | Monitorv3 | — | Chain |
| Jul 17, 2026 at 5:25 PMWeek 6 | N. OyelaranCredit Administration | pasteChatGPT (personal) | Credit Memos, Member PII | Warnv3 | abandoned | Chain |
| Jul 17, 2026 at 5:22 PMWeek 6 | H. DelacroixCredit Administration | promptChatGPT (personal) | Loan Files, Member PII | Warnv3 | redirected | Chain |
| Jul 17, 2026 at 4:44 PMWeek 6 | T. BeaulieuCommercial Lending | promptChatGPT (personal) | Member PII, SSN / Tax ID, Account Numbers | Warnv3 | transformedtrue positive | Chain |
| Jul 17, 2026 at 4:37 PMWeek 6 | K. OseiCommercial Lending | uploadGemini Advanced | Loan Files, Member PII | Warnv3 | overridden | Chain |
| Jul 17, 2026 at 4:26 PMWeek 6 | N. OyelaranCredit Administration | pasteChatGPT (personal) | Loan Files, Member PII | Warnv3 | transformed | Chain |
| Jul 17, 2026 at 4:23 PMWeek 6 | R. OkaforCommercial Lending | promptChatGPT (personal) | Loan Files, Member PII | Warnv3 | redirected | Chain |
| Jul 17, 2026 at 4:21 PMWeek 6 | H. DelacroixCredit Administration | pasteChatGPT (personal) | Loan Files, Member PII | Warnv3 | overridden | Chain |
| Jul 17, 2026 at 3:55 PMWeek 6 | H. DelacroixCredit Administration | uploadClaude.ai (personal) | Credit Memos | Monitorv3 | — | Chain |
| Jul 17, 2026 at 3:28 PMWeek 6 | H. DelacroixCredit Administration | promptGemini Advanced | Loan Files, Member PII | Warnv3 | overridden | Chain |
| Jul 17, 2026 at 3:16 PMWeek 6 | E. LindqvistFinance | pasteGemini Advanced | Member PII, Account Numbers | Monitorv3 | — | Chain |
| Jul 17, 2026 at 2:52 PMWeek 6 | H. DelacroixCredit Administration | promptClaude.ai (personal) | Credit Memos, Member PII | Warnv3 | transformed | Chain |
| Jul 17, 2026 at 2:12 PMWeek 6 | P. NakamuraRetail & Branch Ops | promptM365 Copilot | Member PII | Monitorv3 | —true positive | Chain |
| Jul 17, 2026 at 1:59 PMWeek 6 | A. BergströmCredit Administration | promptClaude.ai (personal) | Member PII, SSN / Tax ID, Account Numbers | Warnv3 | transformed | Chain |
| Jul 17, 2026 at 1:24 PMWeek 6 | I. QuinteroRetail & Branch Ops | pasteClaude.ai (personal) | Account Numbers, Member PII | Monitorv3 | —true positive | Chain |
| Jul 17, 2026 at 1:14 PMWeek 6 | R. OkaforCommercial Lending | uploadGemini Advanced | Loan Files | Monitorv3 | — | Chain |
| Jul 17, 2026 at 12:51 PMWeek 6 | K. OseiCommercial Lending | promptChatGPT (personal) | Member PII, Account Numbers | Warnv3 | transformed | Chain |
| Jul 17, 2026 at 12:42 PMWeek 6 | D. WhitfieldCommercial Lending | uploadMicrosoft Copilot (consumer) | Loan Files, Member PII | Warnv3 | overriddentrue positive | Chain |
| Jul 17, 2026 at 12:39 PMWeek 6 | J. KowalczykRetail & Branch Ops | promptGemini Advanced | Member PII | Monitorv3 | — | Chain |
| Jul 17, 2026 at 12:38 PMWeek 6 | J. KowalczykRetail & Branch Ops | promptClaude.ai (personal) | Account Numbers | Monitorv3 | —true positive | Chain |
| Jul 17, 2026 at 12:20 PMWeek 6 | L. TranRetail & Branch Ops | promptClaude.ai (personal) | Account Numbers, Member PII | Monitorv3 | — | Chain |
| Jul 17, 2026 at 11:35 AMWeek 6 | I. QuinteroRetail & Branch Ops | pasteClaude.ai (personal) | Member PII | Monitorv3 | — | Chain |
| Jul 17, 2026 at 11:26 AMWeek 6 | I. QuinteroRetail & Branch Ops | pasteChatGPT (personal) | Member PII, Account Numbers | Monitorv3 | — | Chain |