Data Motion Validation

Use this section to plan, execute, and collect evidence for tests that prevent data from exiting the Secure Sandbox via data motion channels.

Overview

• Channels in scope: clipboard, dragDrop, screenCapture, screenShare.
• Related surfaces: Devices and external processors used in data-motion pipelines.

Controls Catalog

• Policy surfaces: runtime.dataMotion.settings, runtime.dataMotion.rules[].
• Image-size matching: match.imageMegapixels (min/max in megapixels), match.imageDimensions (width/height min/max in pixels).
• Adversarial focus: allowlist-only posture, classification-aware denies, watermarking/blur deterrence, image-size-gated egress.

Evidence Standards

• Required audit fields per test: category, subCategory/channel, action, outcome, rule.id, priority, bytes/items, classification, watermarkTemplateUsed, integrity.hash/prevHash, and context (sessionId, appId, siteRef).

In This Section

• Clipboard Egress Tests
• Clipboard Bypass and Evasion Tests
• Drag-and-Drop Egress Tests
• Screen Capture and Share Egress Tests
• Browser Uploads Egress Tests
• Devices Egress Tests
• External Processors Egress Tests
• Cross-Channel Exfiltration Tests
• Real-Time Streams Egress Tests
• Pipeline Fail-Closed Tests