EntitlementsM1
Database-enforced entitlements
Program scope, purpose grants and masking hold on every read path, including direct API calls.
Done when: The policy self-test passes for 6 personas x 4 purposes x 5 datasets.
Strategy
Delivery plan
Milestones, each with the outcome it delivers and the test that says it is done.
Shipped
4Running in this product today
Partner dataM2
Contracted partner aggregates
The partner gets program insight without one cardholder row leaving the bank.
Done when: No cell under 25 cardholders ever returns a value to the partner.
AIM3
Governed AI analyst
Analysts ask in plain English; answers respect the same entitlements.
Done when: The model never writes SQL that reaches the database; every answer runs on masked views.
GovernanceM4
Tamper-evident audit
Every access leaves a record an examiner can verify.
Done when: Altering any logged row breaks chain verification at that row.
In progress
1Being built
EntitlementsM5
Identity-bound access
Policies read signed identity claims; persona switching goes away.
Done when: A request without a valid signed claim sees nothing.
Next
1Planned
GovernanceM6
Unmask exception workflow
A time-bound, approved unmask replaces standing privilege.
Done when: A granted exception expires within 15 minutes without user action.