How should I judge grounding and disclosure risk in a generated release?

**How should I judge grounding and disclosure risk in a generated release?**

Treat both as questions to test in a sample, not as settled properties.

**What is grounding?**

It is how closely the generated records follow the way a business handles payments: the kinds of exceptions, the handovers, the policy wording. MirrorFirm's approach is informed by direct observation of how businesses operate, but the output is generated. Ask what the release was grounded in, in general terms, and read cases to see whether they seem plausible to someone who does the work.

**What is disclosure risk?**

It is the chance that generated content resembles a real organisation, person, account or document closely enough to be identified. Generation alone does not rule this out, so inspect it.

**What checks can I run?**

- Search free-text fields for names, addresses, bank details and unusual phrases. - Look for near-duplicate cases that suggest memorised source material. - Check that identifiers follow generated styles and do not look like live formats. - Ask a domain reviewer to read a handful of cases.

**What should I tell my customers?**

State that the material is generated, describe the checks you ran, and avoid claiming privacy or regulatory outcomes. Your customers remain responsible for their own assessment under their obligations.