Generated sample organisation · synthetic

Data explorer

Southern Harbour Mutual (synthetic) is a generated organisation: one working day, 20 October 2026, of 48 staff in 12 departments, 3 service agents and 162 AI interactions, with a private answer key recording everything that happened. This page is an example of what a MirrorFirm generated dataset and environment contain. Every person, organisation, identifier and record here is synthetic, and the secrets in the sample are representative values for evaluation.

Synthetic sample · Southern Harbour Mutual

What your logs see, and what really happened

The simulation writes the records your connectors would actually collect. Each dot is one AI interaction at Southern Harbour Mutual (synthetic), plotted by person and time of day. Switch views, or open the table, to see what the logs miss.

Approved tool, content captured
Approved tool, metadata only

AI interactions by person and hour

162 AI interactions, one dot each for the 160 between 6:00 and 19:00, plotted by person against the hour of the sample day. 141 of them reached a log and 21 reached no log at all; 36 are leak events. The table lists every interaction with its tool, whether any log captured it and what content that log holds.

Show as table

Every AI interaction on the sample day, by time.
Time	Person	Tool	Logged	Content
01:00	Reconciliation Assistant	Workflow agent	yes	partial
01:30	Reconciliation Assistant	Workflow agent	yes	partial
09:02	IT Ticket Assistant	Workflow agent	yes	partial
09:05	IT Ticket Assistant	Workflow agent	yes	partial
09:15	Stefan Gruber	Office assistant	yes	full
09:17	Claims Triage Assistant	Workflow agent	yes	partial
09:20	Nathan Garrow	Office assistant	yes	full
09:25	Robyn Castellano	Office assistant	yes	full
09:31	Kenneth Whitby	Enterprise chat	yes	full
09:35	Claims Triage Assistant	Workflow agent	yes	partial
09:35	Claims Triage Assistant	Workflow agent	yes	partial
09:35	Kenneth Whitby	Enterprise chat	yes	full
09:39	Ivy Marchetti	Personal AI account (unsanctioned)	no	none
09:42	Claims Triage Assistant	Workflow agent	yes	partial
09:42	Louis Bergeron	Personal AI account (unsanctioned)	no	none
09:50	Claims Triage Assistant	Workflow agent	yes	partial
09:51	Stefan Gruber	Coding assistant	yes	none
09:53	Duncan Barr	Office assistant	yes	full
09:54	Freya Lindgren	Personal AI account (unsanctioned)	no	none
09:54	Sofia Milinkovic	Office assistant	yes	full
09:57	Stefan Gruber	Coding assistant	yes	none
10:02	Tomas Varga	Enterprise chat	yes	full
10:03	Stefan Gruber	Coding assistant	yes	none
10:07	Ivy Marchetti	Personal AI account (unsanctioned)	no	none
10:08	Robyn Castellano	Enterprise chat	yes	full
10:13	Mia Castellanos	Coding assistant	yes	none
10:13	Felix Abernathy	Enterprise chat	yes	full
10:16	Mia Castellanos	Coding assistant	yes	none
10:21	Robyn Castellano	Enterprise chat	yes	full
10:25	Aisha Nguyen	Enterprise chat	yes	full
10:26	Ivy Marchetti	Personal AI account (unsanctioned)	no	none
10:28	Duncan Barr	Enterprise chat	yes	full
10:32	Duncan Barr	Enterprise chat	yes	full
10:42	Sofia Milinkovic	Office assistant	yes	full
10:44	Nathan Garrow	Enterprise chat	yes	full
10:50	Claims Triage Assistant	Workflow agent	yes	partial
10:52	Reconciliation Assistant	Workflow agent	yes	partial
10:59	Ivy Marchetti	Enterprise chat	yes	full
11:00	Emeka Nwachukwu	Office assistant	yes	full
11:00	Rafael Sotomayor	Office assistant	yes	full
11:00	Helena Ashworth	Office assistant	yes	full
11:07	Duncan Barr	Enterprise chat	yes	full
11:22	Louis Bergeron	Enterprise chat	yes	full
11:25	Stefan Gruber	Coding assistant	yes	none
11:27	Stefan Gruber	Coding assistant	yes	none
11:29	Imogen Kingsley	Office assistant	yes	full
11:29	Sofia Milinkovic	Office assistant	yes	full
11:30	Harriet Voss	Enterprise chat	yes	full
11:32	Robyn Castellano	Personal AI account (unsanctioned)	no	none
11:35	Sofia Milinkovic	Office assistant	yes	full
11:45	Tahlia Rosewarne	Personal AI account (unsanctioned)	no	none
11:47	Sofia Milinkovic	Enterprise chat	yes	full
11:47	Hannah Wexford	Enterprise search	yes	none
11:52	Harriet Voss	Office assistant	yes	full
11:54	Claims Triage Assistant	Workflow agent	yes	partial
11:55	Claims Triage Assistant	Workflow agent	yes	partial
11:59	Duncan Barr	Personal AI account (unsanctioned)	no	none
12:00	Anneliese Rautenberg	Office assistant	yes	full
12:00	Aisha Nguyen	Office assistant	yes	full
12:01	Harriet Voss	Office assistant	yes	full
12:04	Reconciliation Assistant	Workflow agent	yes	partial
12:05	Tomas Varga	CRM assistant	yes	partial
12:08	Robyn Castellano	CRM assistant	yes	partial
12:09	Elias Karagiannis	Enterprise search	yes	none
12:11	Yuki Tanaka	Office assistant	yes	full
12:11	IT Ticket Assistant	Workflow agent	yes	partial
12:14	Ivy Marchetti	Personal AI account (unsanctioned)	no	none
12:20	Robyn Castellano	Personal AI account (unsanctioned)	no	none
12:20	Kenneth Whitby	Office assistant	yes	full
12:29	Claims Triage Assistant	Workflow agent	yes	partial
12:39	Emeka Nwachukwu	Enterprise chat	yes	full
13:25	Nathan Garrow	Enterprise chat	yes	full
13:35	Duncan Barr	Office assistant	yes	full
13:40	Claims Triage Assistant	Workflow agent	yes	partial
13:43	Tomas Varga	CRM assistant	yes	partial
13:50	Emeka Nwachukwu	Enterprise chat	yes	full
13:52	Duncan Barr	Enterprise chat	yes	full
13:53	Louis Bergeron	Enterprise chat	yes	full
13:53	Sofia Milinkovic	Enterprise chat	yes	full
13:53	Reconciliation Assistant	Workflow agent	yes	partial
13:59	Ivy Marchetti	Personal AI account (unsanctioned)	no	none
14:02	Reconciliation Assistant	Workflow agent	yes	partial
14:02	Claims Triage Assistant	Workflow agent	yes	partial
14:04	Gordon Neave	Enterprise chat	yes	full
14:06	Jasmine Okonjo	Office assistant	yes	full
14:09	Duncan Barr	Enterprise chat	yes	full
14:09	Felix Abernathy	Workflow agent	yes	partial
14:24	Felix Abernathy	Enterprise chat	yes	full
14:25	Bilal Cheung	Office assistant	yes	full
14:26	Marcus Ellery	Personal AI account (unsanctioned)	no	none
14:27	Aisha Nguyen	Enterprise search	yes	none
14:27	Hannah Wexford	Enterprise search	yes	none
14:33	Ivy Marchetti	Personal AI account (unsanctioned)	no	none
14:34	Nathan Garrow	Enterprise chat	yes	full
14:36	Gordon Neave	Enterprise chat	yes	full
14:37	Elias Karagiannis	Personal AI account (unsanctioned)	no	none
14:38	Tomas Varga	Enterprise chat	yes	full
14:39	Aisha Nguyen	Enterprise search	yes	none
14:40	Marcus Ellery	Office assistant	yes	full
14:42	Reconciliation Assistant	Workflow agent	yes	partial
14:48	Sofia Milinkovic	Enterprise chat	yes	full
14:52	Rafael Sotomayor	Office assistant	yes	full
14:55	Tahlia Rosewarne	Coding assistant	yes	none
14:57	Callum Reid	Office assistant	yes	full
14:59	Tahlia Rosewarne	Office assistant	yes	full
15:14	Reconciliation Assistant	Workflow agent	yes	partial
15:19	Robyn Castellano	Personal AI account (unsanctioned)	no	none
15:20	Louis Bergeron	Office assistant	yes	full
15:26	Nathan Garrow	Enterprise chat	yes	full
15:29	Rafael Sotomayor	Enterprise chat	yes	full
15:33	Marcus Ellery	Enterprise search	yes	none
15:33	Aisha Nguyen	Enterprise search	yes	none
15:33	Duncan Barr	CRM assistant	yes	partial
15:34	Louis Bergeron	Office assistant	yes	full
15:35	Duncan Barr	CRM assistant	yes	partial
15:37	Elias Karagiannis	Coding assistant	yes	redacted
15:42	Marcus Ellery	Enterprise search	yes	none
15:45	Amelia Hartnett	Office assistant	yes	full
15:45	Ivy Marchetti	Office assistant	yes	full
15:47	Amelia Hartnett	Office assistant	yes	full
15:48	Felix Abernathy	Workflow agent	yes	partial
15:48	Claims Triage Assistant	Workflow agent	yes	partial
15:53	Ivy Marchetti	Personal AI account (unsanctioned)	no	none
15:53	Aisha Nguyen	Enterprise search	yes	none
15:56	Tahlia Rosewarne	Workflow agent	yes	partial
15:59	Bilal Cheung	Personal AI account (unsanctioned)	no	none
16:04	Aisha Nguyen	Office assistant	yes	full
16:06	Aisha Nguyen	CRM assistant	yes	partial
16:09	IT Ticket Assistant	Workflow agent	yes	partial
16:09	IT Ticket Assistant	Workflow agent	yes	partial
16:19	Aisha Nguyen	Office assistant	yes	full
16:21	IT Ticket Assistant	Workflow agent	yes	partial
16:22	Tomas Varga	Office assistant	yes	full
16:24	IT Ticket Assistant	Workflow agent	yes	partial
16:26	Hannah Wexford	Office assistant	yes	full
16:26	Aisha Nguyen	Enterprise search	yes	none
16:29	Louis Bergeron	Enterprise chat	yes	full
16:29	Ivy Marchetti	Personal AI account (unsanctioned)	no	none
16:30	Tahlia Rosewarne	Coding assistant	yes	none
16:32	Tahlia Rosewarne	Coding assistant	yes	none
16:33	Aisha Nguyen	Enterprise search	yes	none
16:36	Reconciliation Assistant	Workflow agent	yes	partial
16:47	Stefan Gruber	Coding assistant	yes	none
16:47	Elias Karagiannis	Coding assistant	yes	none
16:47	Tahlia Rosewarne	Coding assistant	yes	none
16:49	Hannah Wexford	Office assistant	yes	full
16:55	Elias Karagiannis	Enterprise chat	yes	full
16:56	Tahlia Rosewarne	Coding assistant	yes	none
16:57	Ivy Marchetti	Personal AI account (unsanctioned)	no	none
16:57	Imogen Kingsley	Personal AI account (unsanctioned)	no	none
17:01	Kenneth Whitby	Enterprise chat	yes	full
17:02	Hannah Wexford	Office assistant	yes	full
17:03	Dev Malhotra	Enterprise chat	yes	full
17:03	Louis Bergeron	Enterprise chat	yes	full
17:08	Elias Karagiannis	Coding assistant	yes	none
17:09	Duncan Barr	Office assistant	yes	full
17:09	Gordon Neave	Office assistant	yes	full
17:25	Stefan Gruber	Coding assistant	yes	none
17:25	Louis Bergeron	Enterprise chat	yes	full
17:27	Sofia Milinkovic	CRM assistant	yes	partial
17:27	Louis Bergeron	Personal AI account (unsanctioned)	no	none
17:29	Aisha Nguyen	Enterprise search	yes	none

Actuarial and AnalyticsClaimsCustomer ServiceExecutive and StrategyFinanceLegalMarketing and DistributionPeople and CultureProcurement and OperationsRisk and ComplianceTechnology and SecurityUnderwritingService agents

06:0008:0010:0012:0014:0016:0018:00

Scroll sideways to see the whole chart →

2 overnight service-agent run(s) outside 6:00–19:00 not plotted; they are in the table.

Synthetic sample · Southern Harbour Mutual

Follow one claim through the business

AI use in the simulation belongs to connected work. This claim arrives at 11:45 and is settled by 17:00. Along the way it passes through 6 people. One drafts with AI, one asks a colleague, one regenerates an answer they didn’t like, a senior officer signs off, and one quietly uses a personal AI account. Their output still flows on to the next person.

AI tool
Personal AI account
Colleague or approval
Service agent
Checks, edits or accepts output
Handoff

One claim moving between people

6 people in this order: Sofia Milinkovic, Nathan Garrow, Aisha Nguyen, Marcus Ellery, Bilal Cheung, Dev Malhotra. 28 steps, from 11:45 to 17:00. Status milestones: claim lodged; evidence requested; under assessment; approved → payment instructed.

Show as table

Every step of the claim, in time order.
Time	Who	What
11:45	—	Claim lodged and queued
11:47	Sofia Milinkovic	Asks Enterprise chat
12:08	Sofia Milinkovic	Case moves to “evidence requested”
12:08	Sofia Milinkovic	Hands the case to Nathan Garrow
12:08	Sofia Milinkovic	Edits the AI draft
12:16	Nathan Garrow	Asks a colleague a question
13:25	Nathan Garrow	Asks Enterprise chat
13:52	Nathan Garrow	Checks the AI output
13:58	Nathan Garrow	Case moves to “under assessment”
13:58	Nathan Garrow	Hands the case to Aisha Nguyen
13:58	Nathan Garrow	Accepts the output
14:27	Aisha Nguyen	Asks Enterprise search
14:38	Aisha Nguyen	Checks the AI output
14:39	Aisha Nguyen	Regenerates the answer in Enterprise search
15:09	Aisha Nguyen	Checks the AI output
15:16	Aisha Nguyen	Accepts the output
15:27	Aisha Nguyen	Asks a senior colleague for approval
15:39	Marcus Ellery	Reviews and approved
15:39	Marcus Ellery	Hands the case to Bilal Cheung
15:59	Bilal Cheung	Uses a personal AI account, invisible to every connector
16:10	Bilal Cheung	Checks the AI output
16:15	Bilal Cheung	Hands the case to Dev Malhotra
16:15	Bilal Cheung	Accepts the output
16:36	Dev Malhotra	Delegates reconciliation to a service agent
16:54	Dev Malhotra	Checks the AI output
17:00	Dev Malhotra	Case moves to “approved”
17:00	Dev Malhotra	Case moves to “payment instructed”
17:00	Dev Malhotra	Accepts the output

Scroll sideways to see the whole chart →

Synthetic sample · Southern Harbour Mutual

Telemetry as messy as the real thing

Real AI logs don’t agree on who someone is. The simulation gives each person the identifiers each vendor would really use: a legacy address from before a rebrand, an email alias, opaque vendor user IDs, a GitHub handle, a shared desk mailbox, and a personal account nobody monitors. The answer key maps every one back to the right person.

Meet Elias Karagiannis, Actuarial Analyst in Actuarial and Analytics. Across the six vendor logs and a personal account, they appear under 13 different identifiers. The table below lists each one and where it appears.

519: identifier records in the map
10–13: identifiers per employee
48: employees resolved

One person, 13 identifiers

13 identifiers around Elias Karagiannis: 12 appear in at least one vendor log and 1 is a personal account no connector sees. The table lists every one with its formats.

Show as table

Every identifier for this person, and the formats it appears in.
Identifier	Kind	Appears in	Monitoring
277dbdda-9d2f-439e-07eb-ca5dca1d379d	vendor user id	Microsoft Purview (Copilot)	Seen in a vendor log
5911817	vendor user id	GitHub Copilot usage	Seen in a vendor log
593251928299616114667	vendor user id	Google Gemini activity	Seen in a vendor log
ekaragiannis-acct	handle	GitHub Copilot usage	Seen in a vendor log
ekaragiannis@old-trading-name.example	legacy upn	Microsoft Purview (Copilot)	Seen in a vendor log
ekaragiannis@southernharbour.example	upn	Microsoft Purview (Copilot)	Seen in a vendor log
elias.karagiannis@personal-mail.example	personal account	No connector sees it	Not monitored (personal)
elias.karagiannis@southernharbour.example	primary	Google Gemini activity, OpenAI compliance, Anthropic compliance, Anthropic audit CSV	Seen in a vendor log
karagi@southernharbour.example	alias	OpenAI compliance, Anthropic compliance, Anthropic audit CSV	Seen in a vendor log
user-d34a7a0cdd2c7b6b533b3fbd	vendor user id	OpenAI compliance	Seen in a vendor log
user_010a1a6ddaaacc01edef7c58	vendor user id	Anthropic audit CSV	Seen in a vendor log
user_01c71fd63d462f1adebe3b43	vendor user id	Anthropic compliance	Seen in a vendor log
shared-desk@southernharbour.example	shared:shared	Microsoft Purview (Copilot), OpenAI compliance, Anthropic compliance, Anthropic audit CSV	Seen in a vendor log

Scroll sideways to see the whole diagram →

One person, 13 identifiers

The 13 identifiers around Elias Karagiannis are numbered on the diagram; the key lists each number with its identifier and whether a vendor log sees it.

Show as table

Every identifier for this person, and the formats it appears in.
Identifier	Kind	Appears in	Monitoring
277dbdda-9d2f-439e-07eb-ca5dca1d379d	vendor user id	Microsoft Purview (Copilot)	Seen in a vendor log
5911817	vendor user id	GitHub Copilot usage	Seen in a vendor log
593251928299616114667	vendor user id	Google Gemini activity	Seen in a vendor log
ekaragiannis-acct	handle	GitHub Copilot usage	Seen in a vendor log
ekaragiannis@old-trading-name.example	legacy upn	Microsoft Purview (Copilot)	Seen in a vendor log
ekaragiannis@southernharbour.example	upn	Microsoft Purview (Copilot)	Seen in a vendor log
elias.karagiannis@personal-mail.example	personal account	No connector sees it	Not monitored (personal)
elias.karagiannis@southernharbour.example	primary	Google Gemini activity, OpenAI compliance, Anthropic compliance, Anthropic audit CSV	Seen in a vendor log
karagi@southernharbour.example	alias	OpenAI compliance, Anthropic compliance, Anthropic audit CSV	Seen in a vendor log
user-d34a7a0cdd2c7b6b533b3fbd	vendor user id	OpenAI compliance	Seen in a vendor log
user_010a1a6ddaaacc01edef7c58	vendor user id	Anthropic audit CSV	Seen in a vendor log
user_01c71fd63d462f1adebe3b43	vendor user id	Anthropic compliance	Seen in a vendor log
shared-desk@southernharbour.example	shared:shared	Microsoft Purview (Copilot), OpenAI compliance, Anthropic compliance, Anthropic audit CSV	Seen in a vendor log

1277dbdda-9d2f-439e-07eb-ca5dca1d379d Seen in a vendor log
25911817 Seen in a vendor log
3593251928299616114667 Seen in a vendor log
4ekaragiannis-acct Seen in a vendor log
5ekaragiannis@old-trading-name.example Seen in a vendor log
6ekaragiannis@southernharbour.example Seen in a vendor log
7elias.karagiannis@personal-mail.example Not monitored (personal)
8elias.karagiannis@southernharbour.example Seen in a vendor log
9karagi@southernharbour.example Seen in a vendor log
10user-d34a7a0cdd2c7b6b533b3fbd Seen in a vendor log
11user_010a1a6ddaaacc01edef7c58 Seen in a vendor log
12user_01c71fd63d462f1adebe3b43 Seen in a vendor log
13shared-desk@southernharbour.example Seen in a vendor log

Seen in a vendor log
Not monitored (personal)

Six vendor audit formats

The same day exported in six real vendor audit formats, checked against pinned schemas, with clock skew, duplicate deliveries, late arrivals and missing content.

created_at,actor_info,event,event_info,entity_info,ip_address,device_id,user_agent,client_platform
2026-10-19 22:30:51,"{""email"": ""kenneth.whitby@southernharbour.example"", ""uuid"": ""user_013a8dd68cbf2cbeeaf79a1b""}",conversation_created,{},"{""type"": ""chat_conversation"", ""uuid"": ""d4ee022e-aaed-d36b-30dc-033f140b945c""}",198.51.100.79,10dcc46b-b72f-708a-cc3a-d4ac4a7c4e0d,Mozilla/5.0 (X11; Linux x86_64) Synthetic/1.0,

anthropic_audit_log_2026-10-20.csv · 20 rows on this day

{
  "actor": {
    "email_address": "kenneth.whitby@southernharbour.example",
    "ip_address": "198.51.100.79",
    "type": "user_actor",
    "user_agent": "Mozilla/5.0 (X11; Linux x86_64) Synthetic/1.0",
    "user_id": "user_013a6d126e209a455b61ecce"
  },
  "claude_chat_id": "claude_chat_c30bcf0d7caf297c",
  "created_at": "2026-10-19T22:30:51Z",
  "id": "activity_01acbc9a5f1d4eda0e73de8e",
  "organization_id": "org_01bbcba87cc44d0fda19da47",
  "organization_uuid": "4b2e455e-14fa-8c4b-488d-bb2ca44b72db",
  "title": null,
  "type": "claude_chat_created"
}

anthropic_compliance_activity_2026-10-20.jsonl · 22 rows on this day

{
  "ai_adoption_phase": {
    "phase": "Phase 1",
    "phase_number": 1,
    "version": "v1"
  },
  "ai_credits_used": 0.0,
  "client_telemetry_present": true,
  "code_acceptance_activity_count": 0,
  "code_generation_activity_count": 5,
  "day": "2026-10-20",
  "enterprise_id": "4915106",
  "loc_added_sum": 0,
  "loc_deleted_sum": 0,
  "loc_suggested_to_add_sum": 13,
  "loc_suggested_to_delete_sum": 0,
  "totals_by_client": [],
  "totals_by_feature": [
    {
      "code_acceptance_activity_count": 0,
      "code_generation_activity_count": 5,
      "feature": "code_completion",
      "loc_added_sum": 0,
      "loc_deleted_sum": 0,
      "loc_suggested_to_add_sum": 13,
      "loc_suggested_to_delete_sum": 0,
      "user_initiated_interaction_count": 0
    }
  ],
  "totals_by_ide": [
    {
      "code_acceptance_activity_count": 0,
      "code_generation_activity_count": 5,
      "ide": "visualstudio",
      "last_known_ide_version": {
        "ide_version": "7.55",
        "sampled_at": "2026-10-20T05:55:46Z"
      },
      "loc_added_sum": 0,
      "loc_deleted_sum": 0,
      "loc_suggested_to_add_sum": 13,
      "loc_suggested_to_delete_sum": 0,
      "user_initiated_interaction_count": 0
    }
  ],
  "totals_by_language_feature": [],
  "totals_by_language_model": [],
  "totals_by_model_feature": [],
  "used_agent": false,
  "used_chat": false,
  "used_cli": false,
  "used_copilot_app": false,
  "used_copilot_cloud_agent": false,
  "used_copilot_code_review_active": null,
  "used_copilot_code_review_passive": null,
  "used_copilot_coding_agent": false,
  "used_local_byok": null,
  "user_id": 3438872,
  "user_initiated_interaction_count": 0,
  "user_login": "trosewarne-acct"
}

users-1-day_2026-10-20.ndjson · 3 rows on this day

{
  "actor": {
    "callerType": "USER",
    "email": "nathan.garrow@southernharbour.example",
    "profileId": "143304576962528312232"
  },
  "etag": "\"etag_3d6f158d290fe39c\"",
  "events": [
    {
      "name": "feature_utilization",
      "parameters": [
        {
          "name": "action",
          "value": "summarize"
        },
        {
          "name": "app_name",
          "value": "docs"
        },
        {
          "name": "event_category",
          "value": "active_summarize"
        },
        {
          "name": "feature_source",
          "value": "side_panel"
        }
      ],
      "type": "ai_usage_event"
    }
  ],
  "id": {
    "applicationName": "gemini_in_workspace_apps",
    "customerId": "Ceaafdcbc",
    "time": "2026-10-19T22:19:59.478Z",
    "uniqueQualifier": "9539354968905097953"
  },
  "ipAddress": "192.0.2.125",
  "isAgenticAction": false,
  "kind": "audit#activity",
  "ownerDomain": "southernharbour.example"
}

google_gemini_activity_2026-10-20.jsonl · 12 rows on this day

{
  "actor": {
    "type": "ACCOUNT_USER",
    "user_email": "t.varga@southernharbour.example",
    "user_id": "user-fb9b90ff9ebc7f9fd54a806a"
  },
  "conversation": {
    "created_at": null,
    "id": "convo_badcf42fc6bb067d",
    "is_locked_chat": false,
    "is_pinned": false,
    "is_temporary_chat": false,
    "mode": "chat",
    "title": null
  },
  "event_id": "63eb0afa-3b5a-493a-715d-b5ec7b2f054e",
  "message": {
    "author": {
      "client_type": "desktop_web",
      "type": "user"
    },
    "id": "msg_8fabe08f124cec5b"
  },
  "principal": {
    "id": "e6ccef4d-3a5a-4d6b-f7fb-fc4d4f8d2b1a",
    "type": "CHATGPT_WORKSPACE"
  },
  "timestamp": "2026-10-19T23:01:34.308883Z",
  "type": "CONVERSATION_MESSAGE"
}

openai_compliance_logs_2026-10-20.jsonl · 22 rows on this day

{
  "ClientIP": "198.51.100.253",
  "CopilotEventData": {
    "AppHost": "Excel",
    "AppIdentity": "Copilot.MicrosoftCopilot.Excel",
    "Messages": [
      {
        "Id": "msg_818d131ed68fcb4e",
        "isPrompt": true
      },
      {
        "Id": "msg_435d53fca9dd1f0c",
        "isPrompt": false
      }
    ],
    "ThreadId": "19:a78b869ccbcbc64e94bc355ecc8a920d@thread.v2"
  },
  "CreationTime": "2026-10-19T22:14:58",
  "Id": "7d6b411b-8f3f-9d9c-1d6c-1afd43fbc1eb",
  "Operation": "CopilotInteraction",
  "OrganizationId": "b91e24ba-8f5c-273b-4c5f-9e0a91bcddea",
  "RecordType": 261,
  "ResultStatus": "Succeeded",
  "UserId": "stefan.gruber@southernharbour.example",
  "UserKey": "f35ae8fc-ea1a-a37b-bfaa-3c1b368f0d9b",
  "UserType": 0,
  "Version": 1,
  "Workload": "Copilot"
}

purview_copilot_interaction_2026-10-20.jsonl · 27 rows on this day

Show as table

The same day in six vendor formats, with the sample row and row count for each.
Vendor format	File	Rows
Anthropic audit CSV	anthropic_audit_log_2026-10-20.csv	20
Anthropic compliance	anthropic_compliance_activity_2026-10-20.jsonl	22
GitHub Copilot usage	users-1-day_2026-10-20.ndjson	3
Google Gemini activity	google_gemini_activity_2026-10-20.jsonl	12
OpenAI compliance	openai_compliance_logs_2026-10-20.jsonl	22
Microsoft Purview (Copilot)	purview_copilot_interaction_2026-10-20.jsonl	27

Synthetic sample · Southern Harbour Mutual

When things go wrong

Risky behaviour comes out of the same simulation. Someone under pressure pastes a whole document, a crunch makes shortcuts more likely, a careless habit repeats. On the sample day that produced 36 data-exposure events. Each one is recorded in the answer key with its cause and intent, next to 59 lookalike decoys that a precise detector should ignore. Each card below is labelled with its answer.

11 of 36: leaks never reached a sanctioned log

Leak events, from the answer key to discovery, on the sample day.

Leak events in the answer key: 36. Reached a sanctioned log: 25. Content captured in the log: 23. Discovered by the organisation: 3

Show as table

Stage	Events
Leak events in the answer key	36
Reached a sanctioned log	25
Content captured in the log	23
Discovered by the organisation	3

Other scenarios run on the same company: a hidden insider with an exfiltration plan, an AI tool outage, a surge in customer demand, deadline pressure, or a counterfactual branch where nobody uses AI at all. Everything else stays the same, so you can compare one change at a time.

Leak

The claimant: Board paper summary: capital plan options and the preferred pricing response. [MNAJAK]
The insured party: A bid for a smaller competitor is under board consideration and unannounced. [RWKERD]

Leak: confidential document translation. Recorded intent: accidental. It was pasted into the Workflow agent alongside an unrelated request.

Safe (decoy)
```
**** **** **** 4861
```
Decoy: masked card. It was planted as a near miss for “masked card”. Flagging it counts as a false positive.

Leak

The applicant: Claim relates to a knee reconstruction with a rehabilitation plan over several months. [BHGVYM]

Leak: health information in claims. Recorded intent: convenience violation. Sent to the Enterprise chat.

Safe (decoy)
```
fa165c7bc05579b2a8b4eebf71cd969abb39dc7fac25cc9417f655a4266f204c
```
Decoy: lookalike token. It was planted as a near miss for “api keys in code and logs”. Flagging it counts as a false positive.

Leak

DATABASE_URL=mongodb://svc_d255:QfgMgiRGNjVTqY@db-3c6.example.invalid:5432/app
SERVICE_SECRET=kgxqof6j3KoTKEZBNyJirWBWhEXAMPLE
API_TOKEN=ghp_WG4KiZR4ZXbkLTVTh5LFVOQSF7qQsEXAMPLE

Leak: connection strings and keys. Recorded intent: accidental. Sent to the Enterprise chat.

Safe (decoy)
```
Customer: [REDACTED]
Document number: [REDACTED]
DOB: [REDACTED]
```
Decoy: redacted document. It was planted as a near miss for “correspondence pasted whole”. Flagging it counts as a false positive.

Synthetic sample · Southern Harbour Mutual

What’s in a run

Three separate data products. Your evaluator only ever gets the first two. Scoring uses the third.

1 · Observable dataset

ai_interactions, model_calls, agent_spans (Parquet + JSONL)
Raw source records from six connector types
Vendor-format exports: Purview, GitHub Copilot, Gemini, OpenAI, Anthropic
Cost estimates and model fields, labelled as estimates

2 · Organisational context

Staff directory, managers, departments, entitlements
Approved AI tool inventory
Business artifacts, with time and access boundaries

3 · Private answer key

The full causal event log: every task, handoff, message and decision
Each person’s traits, skill, fatigue, trust and habits over time
A label for every interaction: task, workflow, intent and outcome
Reactions to each reply, shadow-AI use, risk events, and the identity map

Every run ships a quality report: 26 automated gates covering schema validity, causal order, truth isolation, source fidelity, day boundaries and reproducibility. 23 pass on this sample day.

Download the sample pack

ZIP, about 2.1 MB

The pack holds the observable dataset, the organisational context and the private answer key for this day, with the README, FAQ, data dictionary and scoring example. It contains the private answer key and planted dummy secrets for evaluation.

All people, organisations and data on this page are synthetic. Behavioural settings are declared modelling assumptions, not measurements of any real organisation. Cost and model fields are estimates for the vendor products represented.

Bring a training objective.
We’ll scope the business world.

Start with observed operations, a defined objective and a sample you can inspect.

Request a sample world ↗

Data explorer

What your logs see, and what really happened

Follow one claim through the business

Telemetry as messy as the real thing

When things go wrong

What’s in a run

1 · Observable dataset

2 · Organisational context

3 · Private answer key

Bring a training objective.We’ll scope the business world.

Bring a training objective.
We’ll scope the business world.