Skip to content

0.5.12-pii-egress-canary-2026-08-11.md

Latest commit

 

History

History
66 lines (50 loc) · 2.99 KB

0.5.12-pii-egress-canary-2026-08-11.md

File metadata and controls

66 lines (50 loc) · 2.99 KB
Raw

0.5.12 PII egress observe canary — 2026-08-11

Status: synthetic acceptance complete; this is not an automatic enforcement decision.

Deployment and evidence

main was restarted into the merged 0.5.12 implementation at 07:22 CDT and again at 07:28 CDT after removal of the temporary canary policy. The safe GET /health/liveliness endpoint returned "I'm alive!" after each restart.

The value-free report was generated with:

.venv/bin/python scripts/measurement-report.py pii-egress \
  logs/airlock-2026-08-11.jsonl

The report contained five airlock_pii_egress events, all in observe mode:

Synthetic route Decision Reason Client result
configured round-trip email allow round_trip exact value hydrated
exfil email without residual grant deny exfil_not_allowlisted exact value hydrated (observe)
exfil email with scoped residual grant allow residual_allow exact value hydrated
sensitive test payment identifier in round-trip route deny sensitive_class exact value hydrated (observe)
unknown email tool deny unknown_tool exact value hydrated (observe)

The payment test identifier was recognized as US_BANK_NUMBER, which is in the same default-sensitive veto set as card/SSN classes. The expected policy outcome was therefore preserved.

No external tool was executed. The client receives hydration only because this was an observe-mode run; the three deny decisions emitted would_suppress.

Containment checks

  • A global JSONL sweep found zero airlock_pii_map keys after the historical logs were scrubbed and rotated.
  • A sweep for each synthetic value found zero serialized copies in the Airlock JSONL logs.
  • The telemetry record retains the response before hydration; only the client return value was checked against the synthetic input.

Metric interpretation and DECIDE

This run proves the five policy branches and sink containment with synthetic traffic. It does not prove the traffic-distribution metrics required for layered enforcement: a single round-trip example cannot establish M1's >=90% rate; the synthetic window cannot establish M3 residual-list stability or M6 unknown-tool reduction. Four earlier .test-domain requests were not recognized by the active email recognizer and produced no egress events; the final five events above use recognizer-supported reserved example.com addresses.

Owner DECIDE

2026-08-11: retain observe. The owner chose to keep the release in its safe default observe mode while representative dogfood traffic is collected. No interim known-bad blocklist is enabled today.

The promotion path is implemented and tested: set AIRLOCK_PII_EGRESS_MODE=enforce and configure AIRLOCK_PII_EGRESS_BLOCKLIST as a JSON list of {tool, path, entity_type} entries, then restart Airlock. The blocklist is a deny override, so it wins over both a round-trip band and a scoped residual allow. This remains a future owner change after the representative metrics justify it.