# Eve sensitive-data boundary controls — Task 14.3

Date: 2026-09-15 Scope: Eve assistant data minimization, redaction, secret
detection, sensitive-data detection, and exfiltration resistance Machine record:
`docs/audits/eve-sota-sensitive-data-boundaries/2026-09-15.json`

## Result

The candidate defines one bounded guard contract for all ten Task 14.3
boundaries: ingress, prompt assembly, tool result, trace/log, screenshot, audio,
video, artifact, eval evidence, and egress. The machine record binds each
boundary to its implementation and regression tests. A semantic verifier checks
the exact inventory, source tokens, test tokens, media completeness
requirements, ephemeral keyed receipt binding, and eval scanner version.

The shared guard detects credential shapes without depending on a
registered-secret list, direct personal-data patterns, recursively encoded
disclosures, secret-named structured fields, unsafe object graphs, incomplete
media extraction, and incomplete or oversized archives. Findings contain
category and structural ordinals only. Receipts bind input and output using a
process-ephemeral HMAC-SHA-256 key so retained metadata cannot become a
dictionary oracle for low-entropy identifiers.

The browser screenshot path uses a real DOM renderer. Private regions, form
values, assistant UI, script/style/template content, embedded media, CSS image
content, custom-element content, and shadow content are omitted. Complete
bounded text from the sanitized DOM is inspected before the image is admitted to
the reviewed vision route. Desktop and mobile Playwright runs verify visible
chart pixels survive while private pixels and values do not.

## Adversarial coverage

The candidate exercises structured secret fields and keys; Base64, hexadecimal,
percent, and nested encodings; image/OCR extraction; complete and incomplete
archives; provider-delta splitting; and encoded tool-result-to-tool-argument
smuggling. Size, depth, node, candidate, media-extraction, and
archive-enumeration exhaustion fail closed.

Eval evidence is scanned over complete artifact bytes with
`eval-data-sensitive-v2`, which adds direct personal data plus recursively
encoded sensitive content to the existing credential and email checks. Existing
Task 12.5 governance evidence is regenerated whenever this scanner or its bound
registry changes.

## Exact limitations

- Raw server-STT audio reaches only a Task 14.2-admitted speech provider before
  the returned transcript can be inspected. No local pre-provider ASR claim is
  made.
- Screenshot admission is limited to sanitized DOM rendering plus complete
  bounded DOM text. Non-DOM media is hidden, not classified by pixel OCR.
- Video admission scans structured provider payloads and requires a complete
  clean delivered transcript; it does not perform frame-by-frame OCR over
  arbitrary video pixels.
- This task establishes data-boundary inspection and minimization, not the
  attachment/generated-artifact retention, sharing, export, deletion, or backup
  lifecycle owned by Task 14.8.
- The Playwright vision endpoint is a deterministic provider double. It proves
  the real browser, screenshot, client-tool, BFF, privacy, and cancellation
  boundaries, not a live external model call or provider quality.

Phase 14 and G16 remain open after this task; Tasks 14.4 through 14.8 own the
remaining rights, retention/access, legal-applicability, media-rights, and
artifact-lifecycle work.