How should we assess grounding and disclosure risk in a generated booking sample?

**Is the data real?** No. MirrorFirm output is generated and does not contain real business records. It is informed by how businesses operate, which is a different thing from copying their data.

**Does generated mean risk-free?** No. Generation does not guarantee anonymity, privacy compliance or regulatory approval. Treat disclosure as a risk to inspect, not a property you can assume.

**What can we check ourselves?** - Search for identifiers that look like real ABNs, account numbers or addresses and test whether they resolve to real entities. - Compare free-text fields against public sources and your own internal documents for near-copies. - Look for rare combinations, such as an unusual product with a distinctive amount and date, that could point to a single real case. - Check that names of organisations in the data are generated or are Aster Financial.

**What should we ask the provider?** How content was produced, what grounding material informed it, what overlap checks were run, and what the process is if a reviewer finds a concern.

**What about realism?** Have an operations reviewer assess whether conditions, handover notes and exception reasons read as a practitioner would write them. Record disagreements and feed them back during the pilot.