Signed in asM. HalloranCompliance officer · Compliance/BSAThe console in full: every actor, every event, the adjudication queue, and the actions on the pending policy proposal.
The moment · simulated sensor
What the employee sees, a second before the data leaves
This page is a simulation of a public AI tool, and nothing else on it is. No browser extension is installed and none exists in this demo: the window below is drawn by this app. What is real is everything behind the sensor — the detectors, the policy resolution, the transforms and the record the product would write are the product’s own code, running server-side on every send. Text you type is inspected in the request and stored nowhere, which is why your own intercept never appears in Events.Policy v5 resolves for OperationsMember PIImonitorAccount NumbersmonitorLoan FilesmonitorCredit MemosmonitorSSN / Tax IDmonitorAPI Keys / CredsblockBSA / AML MaterialblockRetail & Branch Ops is still monitor-only. That is what the v6 proposal is about.
User prompt (sent to the provider):
The engine runs server-side on send. Nothing typed here is stored.
Planted promptsAttach a file from the pilot
How to read it
One prompt, five principals, four rungs
The detection never changes: the same characters produce the same spans with the same offsets and the same proof, whoever is signed in. What changes is the decision, because policy v5 — in force since Aug 3, 2026 — puts each role group on a different rung. Send the loan application as the lender and it redacts; as the credit analyst it coaches; as the Retail CSR it is logged and nothing else. Send the credential as the IT contractor and it is blocked; send it as the compliance tester and the same block is softened to a warning by a named exception, and logged. The SAR narrative is the one prompt where nothing moves: SAR confidentiality is statutory, so that class is blocked for every role group and every destination from v1 — a bank does not pilot its way up to it.Attaching a file shows the state the specification never draws: the deterministic layer has answered, the contextual layer is still reading, and a fail-closed posture holds the submission rather than waving it through. The hold is rendered for a stated 1400 ms here so it can be seen; the product’s prompt budget is 800 ms at p95, and an upload is the case that budget cannot promise.
The transform is preview-and-confirm, never a silent rewrite: the transformed text is shown, the person whose words they are confirms it, and the original is not submitted. Response-side detokenization — the answer coming back speaking in tokens — is out of scope in this demo and said so rather than implied.