Lab 01
Privacy Boundary Lab
A local demonstration of deterministic identity protection before data crosses an AI service boundary.
LOCAL DETERMINISTIC DEMO · NO EXTERNAL AI
This is a portfolio-scale educational reconstruction using simplified recognizers and fictional data. It is not production-grade de-identification, anonymization or legal/compliance assurance.
Where identity lives
- Customer zone · raw identityTrusted input
- Customer zone · raw identityLocal detection
- Customer zone · raw identityStable tokens
- Outside · tokens onlyExternal AI boundaryDeterministic simulation
- Outside · tokens onlyToken-preserving response
- Customer zone · raw identityAuthorized restoration
Run the demonstration
- Trusted input
- Local entity detection
- Stable tokenization
- Outbound payload inspection
- Simulated external processing
- Authorized restoration
Status Load a fictional sample or type fictional text to begin.
Named outcome
NOT YET EVALUATED
Protect identifiers to evaluate the outbound payload.
Why the lab stopped
A · Trusted customer zone
Original input and local detection
Stays in this page. Nothing is stored or sent.
Local detection results
Not analyzed yet.
B · Outbound payload
Exactly what would leave the customer zone
Tokens are highlighted. Anything marked as residual is a possible raw identifier.
C · Protected identity map
Token-to-value mapping (stays in the customer zone)
Collapsed by default. A production system would protect this mapping with stronger access controls, encryption, key management and auditing.
| Token | Type | Fictional value |
|---|
No protected session.
SIMULATED EXTERNAL RESULT
Deterministic stand-in for an external AI service
No network request and no model. A fixed rule set rewrites the tokenized payload and keeps every token exactly.
Authorized restoration
Restore inside the trusted zone
This checkbox demonstrates an authorization boundary. It is not real authentication.
Clearing removes this page's references to the input, payload and mapping and empties the fields. It is not cryptographic memory erasure.
Test a failure
Each scenario runs the same engine with fixed fictional input and shows which named outcome it produces, and why.
Audit timeline
Records what happened, never the protected values.
No events yet.
What production would additionally require
This lab shows the shape of the boundary. A production deployment would additionally require:
- stronger entity detection;
- domain-specific evaluation;
- formal threat modeling;
- encryption and key management;
- real identity and access management;
- tamper-resistant audit records;
- retention and deletion policies;
- secure execution boundaries;
- monitoring and incident response;
- privacy and legal review.
Browser-side pattern matching alone does not provide production privacy protection.