Concepts
The risk-axis model
PayloadGlass does not reduce a file to a single “malicious / clean” number. Risk depends on what you are about to do with the content — open it, index it into a RAG corpus, forward it externally, hand it to an agent. So the engine reads several lenses (axes) over one evidence graph; the set is not a fixed or universal list. One artefact routinely scores on several at once.
The axes
| Axis | Question it answers | Examples |
|---|---|---|
| Hostility | Could this content harm a system, user, or agent by executing, exploiting, fetching, evading, or chaining behaviour? | JS/macros, LNK, SVG smuggling, exploit primitives, droppers |
| Deception | Does this content manipulate a human into an unsafe action? | QR phishing, fake login, ClickFix, brand impersonation |
| AI-ingestion | Could this content corrupt or manipulate an AI/RAG/agent workflow? | hidden prompts, retrieval-visible instructions, tool-use directives |
| Sensitivity | Would exposure, indexing, retention, or sharing of this content cause harm? | secrets, credentials, PII, regulated or confidential data |
| Provenance | Does origin, custody, or trust context increase risk? | MOTW loss, external sender, unauthenticated source |
The axes are disjoint by question, not by evidence — the same finding can inform several axes.
Two disciplines that keep it trustworthy
Three lenses drive the verdict; two are advisory. The malicious / suspicious / benign label is the worst of just hostility, deception, and
AI-ingestion. Sensitivity and provenance are advisory governance
lenses that never feed the threat score — so a document full of secrets is
not thereby “malicious,” and a phishing lure is not hidden behind a low
sensitivity reading. workflow_action folds into AI-ingestion as a sub-signal;
cdr_residual is a meta-lens that reads Unknown until a sanitise + verify-rescan
runs.
Governance is a derived projection, not an axis. The target is a destination-aware projection (roadmap, see below): the answer to “is this safe to open / index / forward / send to an agent?” would be computed from the axes’ evidence plus coverage, provenance, destination, and the active policy profile (safe to open locally ≠ safe to index in RAG ≠ safe to forward externally). Detectors produce evidence; policy — not the detector — decides.
What ships today vs. what’s on the roadmap
The secret and PII detection that feeds the sensitivity lens ships today:
evidence-safe (raw secrets are never emitted) and verdict-inert. Sensitivity
is advisory — it gates nothing yet. Provenance reads Unknown on a bare scan
until a host connector supplies origin facts (mark-of-the-web, sender, custody);
that connector is a roadmap item, and is distinct from the tamper-forensic
findings (revision overlays, date and producer contradictions), which do ship.
The destination-aware governance layer (the safe_to_* projections and the
enforcing gateway decisions) is on the roadmap.
What this is not
- Not DLP. Sensitivity is one intrinsic axis with policy projections over it — not a per-jurisdiction regulated-content library.
safe_to_indexis notai_ingestion_risk. Ingestion risk is about hostile or poisoned content reaching a model; it does not promise indexing quality.- Governance never rescoring threat. The gateway acts on projections; it does not fold sensitivity back into the malware score.