Coverage-matrix explorer

Which detector classes cover which capture channels, what is implemented at POC depth, what is simulated, and what is not built. Published and versioned, including the gaps.

Coverage matrix v2026.08 · POC depth · as of 2026-08-27 Published artefact

POC IMPLEMENTED runs in the product today; you can exercise it yourself.

SIMULATED the code path is real and runs, exercised by a test harness rather than a real endpoint. Labelled everywhere it appears.

ROADMAP specified, not built. No simulation stands in for it.

Detector classes by capture channel, with the state of each at POC depth.
Detector class	Precision	Default action	Detection	paste content-analysis connector	type force-installed extension	drag-drop content-analysis connector	file-attach content-analysis connector	print content-analysis connector
Singapore NRIC / FIN id.sg.nric	HIGH	hard-block	SHIPPED	SIMULATED	SIMULATED	ROADMAP	ROADMAP	ROADMAP
Malaysia MyKad id.my.mykad	HIGH	hard-block	SHIPPED	SIMULATED	SIMULATED	ROADMAP	ROADMAP	ROADMAP
Indonesia NIK id.id.nik	HIGH	hard-block	SHIPPED	SIMULATED	SIMULATED	ROADMAP	ROADMAP	ROADMAP
Thailand national ID id.th.pid	HIGH	hard-block	SHIPPED	SIMULATED	SIMULATED	ROADMAP	ROADMAP	ROADMAP
Vietnam CCCD id.vn.cccd	HIGH	hard-block	SHIPPED	SIMULATED	SIMULATED	ROADMAP	ROADMAP	ROADMAP
Payment card finance.pan	HIGH	hard-block	SHIPPED	SIMULATED	SIMULATED	ROADMAP	ROADMAP	ROADMAP
IBAN finance.iban	HIGH	hard-block	SHIPPED	SIMULATED	SIMULATED	ROADMAP	ROADMAP	ROADMAP
Secret or credential secret.api-key	HIGH	hard-block	SHIPPED	SIMULATED	SIMULATED	ROADMAP	ROADMAP	ROADMAP
Crown-jewel EDM match demo stand-in — no registry class	HIGH	hard-block	ROADMAP	ROADMAP	ROADMAP	ROADMAP	ROADMAP	ROADMAP
Source code demo stand-in — no registry class	MEDIUM	warn-then-confirm	ROADMAP	ROADMAP	ROADMAP	ROADMAP	ROADMAP	ROADMAP

A cell is the weaker of two states: whether the detector ships, and whether the capture path is real. A POC detector on an unbuilt capture path is not coverage, so the cell reads for the path. This is arithmetic in the page, not a judgement in a spreadsheet — no cell can be set independently of its row and its column.

A channel we do not enforce may still be inventoried. Traffic outside the enforced surface — other browsers, desktop AI apps, API and script traffic — is seen through proxy and DNS log ingestion and feeds the shadow-AI inventory. In this build that ingestion runs against a synthetic log source, so the mechanism is real and the volumes are not.

This matrix is a versioned artefact — v2026.08, published as of 2026-08-27. A cell's state changes by a new version, never by a silent edit in place.

Named out of scope, not discovered during your proof of concept

Voice, images, and file content inside images
Personal and unmanaged devices
Browsers other than managed Chrome and Edge, as enforcement targets — they are detect-only
SaaS-embedded AI features
Non-Windows endpoints
Egress-proxy TLS interception as an enforcement path
Local and on-device models of the Ollama class, which proxy and DNS telemetry cannot see