Policy Recipes: Data Motion

Clipboard, drag-and-drop, and screen capture recipes focused on image size controls and directional gating. Copy these snippets and adjust priorities, thresholds, and processor refs for your environment.

What You'll Learn

• How to tier clipboard image policies by megapixel size
• How to apply asymmetric in/out rules for images
• How to gate outbound images through OCR/DLP inspection
• How to use pixel dimensions to detect multi-monitor captures

---

Progressive Image Policy

Allow small images (thumbnails, icons) immediately, route medium images through DLP/OCR inspection, and deny large captures outright. This mirrors the proven text size-routing pattern applied to image payloads.

Adjust the megapixel thresholds to match your environment. Typical values:

• ≤ 0.25 MP — icons, thumbnails, small UI snippets
• 0.25–2.0 MP — single-window screenshots, cropped captures
• > 2.0 MP — full-screen or multi-monitor captures

{
  "configuration": { "launch": { "runtime": { "dataMotion": {
    "settings": { "clipboard": { "enabled": true, "defaultAction": "deny" } },
    "rules": [
      {
        "id": "img-thumb-allow",
        "enabled": true,
        "priority": 900,
        "channel": "clipboard",
        "direction": "out",
        "match": {
          "mimeTypes": [ { "pattern": "image/*", "patternType": "glob" } ],
          "imageMegapixels": { "max": 0.25 }
        },
        "action": { "type": "allow" }
      },
      {
        "id": "img-medium-inspect",
        "enabled": true,
        "priority": 850,
        "channel": "clipboard",
        "direction": "out",
        "match": {
          "mimeTypes": [ { "pattern": "image/*", "patternType": "glob" } ],
          "imageMegapixels": { "min": 0.25, "max": 2.0 }
        },
        "action": {
          "type": "process",
          "pipeline": [
            { "processorRef": "dlp-ocr", "mode": "inspect" }
          ],
          "onProcessorFailure": "deny"
        }
      },
      {
        "id": "img-large-deny",
        "enabled": true,
        "priority": 800,
        "channel": "clipboard",
        "direction": "out",
        "match": {
          "mimeTypes": [ { "pattern": "image/*", "patternType": "glob" } ],
          "imageMegapixels": { "min": 2.0 }
        },
        "action": { "type": "deny" }
      }
    ]
  } } } }
}

Validate

• Copy a small icon (< 0.25 MP) out of the sandbox — should succeed immediately.
• Copy a window screenshot (~1 MP) out — should route through the dlp-ocr processor. Verify the audit log shows the img-medium-inspect rule and pipeline execution.
• Take a full-screen capture (> 2 MP) — should be denied. Verify the audit log shows the img-large-deny rule.

Asymmetric Image Clipboard

Allow users to paste images INTO sandboxed applications (for productivity) while blocking all image copy-out. This preserves workflows like pasting screenshots into documents or email while preventing visual data exfiltration.

{
  "configuration": { "launch": { "runtime": { "dataMotion": {
    "settings": { "clipboard": { "enabled": true, "defaultAction": "deny" } },
    "rules": [
      {
        "id": "img-in-allow",
        "enabled": true,
        "priority": 900,
        "channel": "clipboard",
        "direction": "in",
        "match": { "mimeTypes": [ { "pattern": "image/*", "patternType": "glob" } ] },
        "action": { "type": "allow" }
      },
      {
        "id": "img-out-deny",
        "enabled": true,
        "priority": 900,
        "channel": "clipboard",
        "direction": "out",
        "match": { "mimeTypes": [ { "pattern": "image/*", "patternType": "glob" } ] },
        "action": { "type": "deny" }
      }
    ]
  } } } }
}

Validate

• Copy an image from the host desktop and paste into a sandboxed application — should succeed.
• Copy an image from inside the sandbox and paste on the host desktop — should be denied.
• Verify both decisions appear in the audit log with the correct direction and rule id.

Asymmetric Image Clipboard with Size-Gated Egress

Combine asymmetric direction control with a size threshold for outbound images. Allow all images inbound but only permit small images (thumbnails, icons) outbound.

{
  "configuration": { "launch": { "runtime": { "dataMotion": {
    "settings": { "clipboard": { "enabled": true, "defaultAction": "deny" } },
    "rules": [
      {
        "id": "img-in-allow",
        "enabled": true,
        "priority": 900,
        "channel": "clipboard",
        "direction": "in",
        "match": { "mimeTypes": [ { "pattern": "image/*", "patternType": "glob" } ] },
        "action": { "type": "allow" }
      },
      {
        "id": "img-out-small-allow",
        "enabled": true,
        "priority": 900,
        "channel": "clipboard",
        "direction": "out",
        "match": {
          "mimeTypes": [ { "pattern": "image/*", "patternType": "glob" } ],
          "imageMegapixels": { "max": 0.25 }
        },
        "action": { "type": "allow" }
      },
      {
        "id": "img-out-large-deny",
        "enabled": true,
        "priority": 850,
        "channel": "clipboard",
        "direction": "out",
        "match": { "mimeTypes": [ { "pattern": "image/*", "patternType": "glob" } ] },
        "action": { "type": "deny" }
      }
    ]
  } } } }
}

Validate

• Paste any image into the sandbox — should succeed.
• Copy a small icon out — should succeed.
• Copy a screenshot out — should be denied.

OCR-Gated Image Egress

Route outbound clipboard images through an external OCR processor, then inspect the extracted text with a DLP service. Deny if sensitive content is detected. This pattern uses the existing external processor architecture.

{
  "configuration": { "launch": { "runtime": { "dataMotion": {
    "settings": { "clipboard": { "enabled": true, "defaultAction": "deny" } },
    "rules": [
      {
        "id": "img-ocr-dlp-out",
        "enabled": true,
        "priority": 900,
        "channel": "clipboard",
        "direction": "out",
        "match": {
          "mimeTypes": [ { "pattern": "image/*", "patternType": "glob" } ]
        },
        "action": {
          "type": "process",
          "pipeline": [
            { "processorRef": "ocr-service", "mode": "inspect" },
            { "processorRef": "dlp-purview", "mode": "inspect" }
          ],
          "onProcessorFailure": "deny",
          "cacheTtlSec": 120
        }
      }
    ]
  } } } }
}

Validate

• Copy an image containing no sensitive text out of the sandbox — should be allowed after pipeline completes.
• Copy an image containing PII or classified text — should be denied by the DLP processor.
• Verify audit events include pipeline step details and processor findings.

Dimension-Based Multi-Monitor Detection

Use imageDimensions to allow clipboard images that fit within a single monitor and deny images whose width or height exceeds the threshold. This catches multi-monitor screenshots and panoramic captures.

Adjust the width and height thresholds to match your display standard. Common values:

• 2560 × 1440 (QHD)
• 1920 × 1080 (FHD)
• 3840 × 2160 (4K — set higher if 4K monitors are standard)

{
  "configuration": { "launch": { "runtime": { "dataMotion": {
    "settings": { "clipboard": { "enabled": true, "defaultAction": "deny" } },
    "rules": [
      {
        "id": "img-single-monitor-allow",
        "enabled": true,
        "priority": 900,
        "channel": "clipboard",
        "direction": "out",
        "match": {
          "mimeTypes": [ { "pattern": "image/*", "patternType": "glob" } ],
          "imageDimensions": { "width": { "max": 2560 }, "height": { "max": 1440 } }
        },
        "action": { "type": "allow" }
      },
      {
        "id": "img-oversize-deny",
        "enabled": true,
        "priority": 850,
        "channel": "clipboard",
        "direction": "out",
        "match": { "mimeTypes": [ { "pattern": "image/*", "patternType": "glob" } ] },
        "action": { "type": "deny" }
      }
    ]
  } } } }
}

Validate

• Copy a single-window screenshot (for example, 1280 × 720) out of the sandbox — should succeed.
• Take a multi-monitor screenshot (for example, 5120 × 1440 on dual QHD) — should be denied.
• Verify audit events report the matched rule id and image dimensions.

See Also

• Data Motion Pipelines
• External Processors
• Audit Trails
• Merging & Precedence