Skip to main content

Managed Judgments: Data and Privacy

Managed judgments use a feature-specific allowlist. SchemaBounce sends only the state documented for that feature. It does not serialize an entire product object and remove fields afterward.

What each feature may inspect​

  • Sensitive-column detection and schema fingerprints use schema metadata only. They never inspect row values.
  • Semantic route fields use route configuration and only the event or item fields selected for semantic evaluation.
  • Reflex gates use trigger configuration and only the event fields declared by that trigger.
  • The agent judgment tool uses the bounded state or item list explicitly supplied to that authorized call. It does not import other tool calls or ambient agent context.

Semantic route and reflex evaluation runs outside the sub-second CDC delivery path. Feature code builds the state from an allowlist, and adding a field upstream does not silently add it to the judgment request.

Data that is always excluded​

  • Credentials, tokens, keys, or decrypted secret values
  • Unselected source payload fields or unrelated row values
  • Arguments and results from other MCP tool calls
  • File bodies or rendered file contents
  • Protected payloads read directly from internal storage

Conversation content is treated as PCI-equivalent data. It can reach a judgment engine only through an accepted, authorized product-runtime feature that explicitly declares that input. It cannot be read or supplied from databases, pods, logs, traces, support tools, or another operator path.

Expanding a feature's allowlist requires a privacy review and an accepted governance decision.

Logs and telemetry​

Operational telemetry may contain workspace ID, feature ID, opaque target ID, timing, question count, band counts, payer, policy version, and a redacted error class.

Telemetry must not contain submitted state, question text, credentials, exact customer content, or conversation content.

Stored results​

SchemaBounce stores product findings and provider-neutral provenance needed to explain them. This can include the target reference, source revision, rule-or-judgment source, band, policy version, question-set version, input hash, freshness, and human confirmation state.

An input hash supports deduplication but cannot be used as a substitute for raw state. Exact distributions and engine model identifiers are restricted to authorized evaluation surfaces.

Tenant boundaries​

Every read and write is scoped to the authenticated workspace. MCP uses the same core API permissions as the console. Knowing another workspace's object ID does not grant access to it.

Subprocessor status​

Managed judgment processing remains behind a platform kill switch until the engine leaves closed private beta and written vendor terms are agreed. The governing product and pricing decisions, dec-063 and dec-064, are accepted. Customer-facing availability does not imply that every planned feature or credential mode is active.