What the employee sees, a second before the data leaves
This page is a simulation of a public AI tool, and nothing else on it is. No browser extension is installed and none exists in this demo: the window below is drawn by this app. What is real is everything behind the sensor — the detectors, the policy resolution, the transforms and the record the product would write are the product’s own code, running server-side on every send. Text you type is inspected in the request and stored nowhere, which is why your own intercept never appears in Events.The Examination team principal reads this surface and does not act on it. Every detection, every class, every decision and the transformed preview are all shown — what is absent is the override path and the confirm-and-submit, because those are acts an employee performs and this principal performs none.
One prompt, five principals, four rungs
The detection never changes: the same characters produce the same spans with the same offsets and the same proof, whoever is signed in. What changes is the decision, because policy v5 — in force since Aug 3, 2026 — puts each role group on a different rung. Send the loan application as the lender and it redacts; as the credit analyst it coaches; as the Retail CSR it is logged and nothing else. Send the credential as the IT contractor and it is blocked; send it as the compliance tester and the same block is softened to a warning by a named exception, and logged. The SAR narrative is the one prompt where nothing moves: SAR confidentiality is statutory, so that class is blocked for every role group and every destination from v1 — a bank does not pilot its way up to it.Attaching a file shows the state the specification never draws: the deterministic layer has answered, the contextual layer is still reading, and a fail-closed posture holds the submission rather than waving it through. The hold is rendered for a stated 1400 ms here so it can be seen; the product’s prompt budget is 800 ms at p95, and an upload is the case that budget cannot promise.
The transform is preview-and-confirm, never a silent rewrite: the transformed text is shown, the person whose words they are confirms it, and the original is not submitted. Response-side detokenization — the answer coming back speaking in tokens — is out of scope in this demo and said so rather than implied.