Status: ready to run; no enforcement decision recorded yet.
Run only in dogfood with synthetic/canary PII. Production PII is not test data.
Keep AIRLOCK_PII_EGRESS_MODE=observe; this is a behavior-preserving measurement
window. The JSONL airlock_pii_egress field is value-free and contains only mode,
counts, tool, JSON pointer, entity class, and decision reason.
After the deployment window, generate the value-free evidence summary with:
.venv/bin/python scripts/measurement-report.py pii-egress logs/ \
--start 2026-08-10T00:00:00+00:00 --end 2026-08-17T00:00:00+00:00The report intentionally ends in human_decision_required: true; it is not an
automatic enforcement switch and it does not substitute for the required
synthetic/canary review below.
| Metric | Target for layered enforce |
|---|---|
| M1 zero-entry rate (round-trip auto-resolved) | >= 90% |
| M2 false-deny on canary-legitimate flows | 0 |
| M3 residual exfil exception growth | plateaus below operator-approved N |
| M4 would-allow into an exfil sink without residual grant | 0 |
| M5 canary PII egress to exfil sink | 0 |
| M6 unknown-tool share | decreases during the window |
- A synthetic email through a configured
round_triptool (must hydrate in observe and count toward M1). - A synthetic email through a configured
exfiltool with no residual entry (must produceexfil_not_allowlisted; M4/M5 remain zero). - A legitimate exfil exception with a scoped residual allow entry (must hydrate in observe and be manually reviewed).
- A default-blocked class such as SSN/card into a round-trip tool (must produce
sensitive_class). - An unknown tool (must produce
unknown_tool).
After the window, record one of:
- layered enforce: all six targets satisfied; promote observe -> shadow -> enforce with the reviewed bands/lists; or
- blocklist interim: M1/M2 proves the route classification is not yet usable; retain telemetry and state a dated migration plan back to layered enforce.
Neither outcome may be inferred from unit tests or an empty telemetry window.