Pipeline Fail-Closed Tests (DM-PIPE)

Validate that data-motion pipelines deny transfers on unknown classifications, transform failures, processor errors, timeouts, and malformed inputs. Prove there is no partial pass-through and that opaque or un-parseable content is treated as high risk.

Objectives

• Enforce onUnknownClassification: "deny" for opaque, encrypted, or unrecognized payloads.
• Deny on processor failure/timeouts: onProcessorFailure: "deny".
• Deny on transform failure: onTransformFailure: "deny"; no partial or fallback leakage.

Preconditions

• Data motion enabled with deny-by-default posture for outbound channels involved in the pipeline.
• External processors (if used) configured with region allowlists and TLS pinning.

Controls Under Test

• runtime.dataMotion.rules[] pipelines with processors and transforms (for example, builtin.stripFormats, htmlSanitize, DLP processor).
• Unknown classification and error handling options: onUnknownClassification, onProcessorFailure, onTransformFailure, and timeouts.

Test Scenarios

ID	Scenario	Procedure	Expected Outcome
DM-PIPE-01	Unknown/Opaque Payload	1) Attempt to transfer base64 ciphertext or password-protected archive. 2) Ensure pipeline cannot classify content.	Denied with onUnknownClassification: "deny"; audit shows classification: unknown and action: deny.
DM-PIPE-02	Transform Failure (Malformed RTF/HTML)	1) Paste malformed RTF/HTML with embedded object/data URI. 2) Force transform step (stripFormats/htmlSanitize).	Denied; audit indicates transformFailure and no partial payload passes.
DM-PIPE-03	Processor Outage/Timeout	1) Use external DLP with short timeout; simulate outage/latency spike. 2) Attempt transfer.	Denied with onProcessorFailure: "deny"; audit shows processorTimeout or unavailable.
DM-PIPE-04	Nested Archives/Polyglot	1) Attempt to transfer .zip containing .7z containing .pdf (deep nesting).	Denied when inspection depth exceeded or unknown; audit shows depthExceeded/opaque.
DM-PIPE-05	Partial Parse / Truncation	1) Send payload that ends mid-structure (e.g., JSON without closing brace).	Denied; onTransformFailure path triggered; no partial delivery.

Evidence Requirements

• Audit category: "dataMotion" with: channel, direction, action, outcome, rule.id, priority.
• Classification context: classification.normalized or "unknown" when applicable.
• Processor/transform context: processor.ref/name, processorOutcome (e.g., timeout, unavailable), transformOutcome (e.g., failure, sanitized).
• Error context: failureReason (e.g., onUnknownClassification, onProcessorFailure, onTransformFailure).
• Correlation: sessionId, appId, siteRef, and integrity.hash/prevHash.

Example Audit Artifact

{
  "timestamp": "2026-01-21T23:52:00Z",
  "category": "dataMotion",
  "channel": "clipboard",
  "direction": "out",
  "action": "deny",
  "outcome": "blocked",
  "rule": { "id": "dm.clip.pipeline.failclosed", "priority": 80 },
  "classification": { "normalized": ["unknown"] },
  "processor": { "ref": "dlp-corp", "outcome": "timeout" },
  "transformOutcome": "not-applicable",
  "failureReason": "onProcessorFailure",
  "sessionId": "9d77a1...",
  "appId": "sandbox-word",
  "siteRef": "prod-eu-1",
  "integrity": { "hash": "sha256-...9ef", "prevHash": "sha256-...712" }
}

Troubleshooting

• Ensure error handling settings are present on the specific rule being evaluated, not only global defaults.
• Validate processor health and timeouts; use realistic network conditions to trigger timeouts without masking by host policies.
• Confirm archives and polyglots are parsed only up to configured depth and that exceeding depth results in deny.

Known Limitations & Negative Space

• Content classification accuracy is out of scope; these tests validate fail-closed behavior only.
• Extremely novel polyglot formats may not be recognized; treat as unknown and require deny posture.