Interactive demo - Project 4
A governed gateway that stops sensitive operational text before it reaches AI tools, external APIs, or downstream logs.
Known PII is detected, masked, or blocked before transit, with operator recovery and a hash-linked receipt for every decision.
Control. Raw inbound text remains client-owned. The event stream returns only safe output, finding metadata, and decision evidence.
StackTypeScript, Next.js, SSE
How detection gaps, over-masking, bulk restrictions, and oversized payloads are contained and resolved.
Trigger
A novel encoding or free-form secret is identified after review.
System action
The unknown format may pass because coverage is intentionally finite.
Operator action
Contain the downstream item, add a detector, and run regression tests.
Evidence
Updated detector suite and policy record
Trigger
Useful operational text is classified as a sensitive format.
System action
The token stays masked until an operator reviews the finding.
Operator action
Release one finding kind for one run with a required reason.
Evidence
Override reason, actor, and receipt
Trigger
8+ findings indicate a possible restricted export.
System action
Forwarding stops and a security review case opens.
Operator action
Acknowledge the case and investigate the source workflow.
Evidence
PRIV-BULK-RESTRICTED and case ID
Trigger
Inbound text exceeds the 4,000-character boundary.
System action
The payload is rejected before pattern scanning begins.
Operator action
Split the content or route it through a bounded batch process.
Evidence
Payload-size gate event
These are bounded operational controls, not a claim of complete secret detection or regulatory certification.
Control flow, data boundaries, and the engineering choices behind safe downstream transit.
Control flow
Sensitive text is bounded, inspected, and governed before any safe output is released to a downstream processor.
Client boundary
Raw operational text remains owned by the calling interface.
Payload gate
Reject content above 4,000 characters before scanning.
Sensitive-data scan
Check five known formats with deterministic rules and Luhn validation.
Policy decision
Pass clean text, sanitize findings, or block restricted density.
Control evidence
Return safe output, finding metadata, and a hash-linked receipt.
Pass
Forward unchanged
Zero findings. Safe text continues with a decision receipt.
Sanitize
Replace and review
Findings become placeholders. A reasoned one-run release handles over-masking.
Block
Stop and open review
At 8+ findings, nothing is forwarded and a security case opens.
Decision ledger
Decision / rationale / cost / mitigation
Findings are fast, explainable, and easy to test.
Cost: Coverage is finite and can miss novel encodings. Mitigation: Expand detector regressions and route uncertain cases to review.
Dump-style payloads should never rely on partial masking.
Cost: Dense legitimate content can be interrupted. Mitigation: Open a review case with a clear exception code and actor action.
Unmasked input never enters the server event stream.
Cost: The interface must render its own inbound comparison. Mitigation: SSE returns only safe output, findings, and receipt metadata.
Operators can recover useful text after an over-mask.
Cost: A temporary exception increases operational risk. Mitigation: Require a reason and record actor, scope, and result on the receipt.
Production boundary
The public runtime performs real bounded scans, redaction decisions, overrides, and review-case generation in process. A production gateway would add centrally managed policies, durable case storage, encrypted audit shipping, and deployment at the edge or API boundary.
Interactive demo
1 Choose a scenario · 2 Run the system · 3 Inspect how it works
Scan
Waiting for payload
Redact
Idle
Decision
Pass / sanitize / block
Expected control path
Run the selected ticket to inspect findings, compare client-owned input with safe downstream output, and review the decision receipt.
