SentraMind
中文 Private Evaluation
← Demonstrations and tools

Effective-policy viewer

Pick a group, destination and detector class to see a resolution trace from the current deterministic policy-engine package. This browser tool does not call a deployed verdict service.

These three groups, five destinations and six rules are a demo policy set published as part of this page. It is not a tenant's policy, no tenant policy is reachable from here, and nothing you select is sent anywhere.
Effective-policy viewer demo policy set v1 · snapshot 0135ba3e7772 Demo policy set Browser demonstration
Evaluation inputs
Stage caps, never escalates: observe → log-only, warn → warn-then-confirm, enforce → the rule action unchanged.
id.sg.nric
SG-FIN-Analysts × unsanctioned × finance.pan · expires 2026-09-30
Logged only
log-only
Effective stage
observe
Evidence capture
snippet
Policy version
v1 · 0135ba3e7772
  1. 01
    log-only → hard-block
    Country ID and payment data to unsanctioned or suspected-AI destinations
    Rule matched on id.sg.nric, id.my.mykad, id.id.nik, id.th.pid, id.vn.cccd, finance.pan, finance.iban; its action is `hard-block`.
  2. 02
    TIER UNAVAILABLEmodel-classification Model-classification content flag (disabled classifier in this build)
    Tier `model-classification` was unavailable and the rule is fail-open, so it did not contribute an action. This is not a clean result.
  3. 03
    hard-block → log-only
    Rollout stage `observe`
    Stage `observe` caps enforcement at `log-only`, so `hard-block` was reduced. Raise the stage to enforce.
Precedence is normative: exception > rollout stage > policy rule action.
This page called evaluate() from @aidom/policy-engine — the same function from the same package used by the POC enforcement path. Not a reimplementation for the web. The trace above is the evaluator's own output, rendered without editing.

What is real here

  • The evaluator: this page imports and calls evaluate() from @aidom/policy-engine directly. No policy logic is re-derived for the web.
  • Eight of the ten sandbox detector classes correspond to classes in the shipped @aidom/detectors registry — checksum arithmetic and structural rules, exactly as in the prompt sandbox.
  • Rollout-stage capping, exception precedence, and the fail-mode rung all run for real.

What this is not

  • The prompt sandbox says "Allowed" when nothing matches. The product has no such rung: the action ladder is log-only → warn-then-confirm → hard-block, and the least restrictive outcome still records the event. This viewer shows the ladder as the contract defines it.
  • Crown-jewel EDM and source-code are demo stand-ins, marked DEMO CLASS wherever they appear — there is no current registry class behind either one.
  • Not a rule editor, not a snapshot uploader, not a dry-run over a corpus, and not connected to any live control plane — those are console surfaces.