演示界面为英文 — 与产品控制台一致。
The same ten cases as the Cases index, paced one step at a time. All cases →
Sentry ships today. This case is a walkthrough of behaviour you can exercise yourself — run the same decision path in the prompt sandbox. Prompt sandbox →
A finance analyst pastes 200 customer rows into ChatGPT
The single most common way sensitive data reaches a public model — and the one a network control cannot see, because the session is TLS to a legitimate business domain.
- 14:32:07Paste into the ChatGPT composer. The browser calls the local connector and blocks before the content reaches the page.
- 14:32:07.04Verdict service: 47 NRIC checksum matches, plus 12 Exact Data Match hits against the enrolled customer-account table. Crown-jewel EDM is a high-precision class, so the rule action is hard-block.
- 14:32:07.06Policy resolves. The user is in SG-FIN-Analysts, which is at enforce stage, so no downgrade applies. No exception is active. Final action: block.
- 14:32:07.09Verdict returned in 91 ms. The paste is never delivered to the page — the content did not reach ChatGPT's DOM, let alone its servers.
- What she seesA dialog naming the category — “customer account records detected” — showing none of the matched content, offering the sanctioned internal assistant instead.
- 14:32:41She clicks through to the internal assistant and pastes again. Re-evaluated against the internal destination profile: NRIC downgrades to log-only, but EDM still blocks. Sanctioned is not unmonitored.
- 14:33:15She removes the account-number column and proceeds. The work gets done.
- What the SOC seesOne block, one redirect-taken, one successful re-submission. Her third override this week aggregates into an incident under the repeated-override rule.
What the SOC sees
One block, one redirect-taken, one successful re-submission. Her third override this week aggregates into an incident under the repeated-override rule.
What it came to
Nothing was leaked, nothing was silently swallowed, and the analyst finished her task 68 seconds later on an approved path. Blocking the destination outright would have cost the same task an afternoon and a shadow-AI workaround.
What it left behind
- One immutable event per capture, verdict, warn, override, block and dispute
- Evidence capture is per rule: none, masked snippet, or full content — with none required where storing matched content would itself breach classification handling
- Override justifications stored under evidence-class protection, because free text typed at the moment of handling sensitive data is content, not metadata
- Every evidence reveal is itself an event: who viewed what, when