Screen Capture and Share Egress Tests (DM-SCREEN)

Validate that screen capture and screen sharing do not expose sandbox content unless explicitly authorized, and that deterrence controls (watermark, blur) are applied consistently.

Objectives

• Enforce block or foreground-only posture for screen capture.
• Verify watermark and blur behaviors, and that screen sharing is disabled when required.

Preconditions

• Policy sets runtime.dataMotion.settings.screenCapture.enabled: true with desired mode and watermark options.
• Screen sharing is disabled unless explicitly allowed: runtime.dataMotion.settings.screenShare.enabled: false.

Controls Under Test

• runtime.dataMotion.settings.screenCapture and runtime.dataMotion.rules[] with channel: "screenCapture".
• runtime.dataMotion.settings.screenShare.

Test Scenarios

ID	Test Scenario	Procedure	Expected Outcome
DM-SCREEN-01	Screenshot Tool	1. Policy: screenCapture enabled w/ Watermark. 2. Host: Use Snipping Tool to capture sandbox window.	Pass: Screenshot contains the visible watermark overlay.
DM-SCREEN-02	Screen Sharing	1. Policy: screenShare.enabled: false. 2. App: Use Teams/Zoom inside sandbox to share screen.	Pass: Screen sharing fails to initialize or transmits black screen.
DM-SCREEN-03	Background Blur	1. Policy: blurBackground: true. 2. Host: Capture window when it is out of focus.	Pass: Captured content is blurred/obfuscated.
DM-SCREEN-04	Host Capture Block	1. Policy: screenCapture.mode: "block". 2. Host: Press PrintScreen or use capture tool.	Pass: Sandbox window renders as black box in the capture.
DM-SCREEN-05	Hardware Overlay/Video Path	1. Play video content inside sandbox using hardware acceleration. 2. Attempt capture with OS tool.	Pass: Overlay path is protected; capture shows watermark/blur or black frame (no clear content).
DM-SCREEN-06	Conferencing Plugin Fallback	1. Use Teams/Zoom plugin-based capture path. 2. Attempt app/window sharing when screenShare.enabled: false.	Pass: Share fails to initialize or transmits obfuscated output; audit shows deny.
DM-SCREEN-07	Foreground-Only Enforcement	1. Enable foreground-only capture. 2. Capture when sandbox window is backgrounded/minimized.	Pass: Output is blurred/black when not foreground.

Evidence Requirements

• Audit category: dataMotion with channel: "screenCapture" or "screenShare", action, outcome.
• Include watermarkTemplateUsed and relevant rule metadata when applicable.
• For foreground-only, include windowState: foreground|background|minimized when available in audit.

Troubleshooting

• Ensure runtime.dataMotion.settings.screenCapture.enabled: true and the intended mode are set.
• For watermark tests, verify the watermark template is configured and active in policy.
• Validate that screen sharing controls target the app in use (Teams/Zoom) and are not overridden by per-app exceptions.

Known Limitations & Negative Space

• Screen capture deterrence (watermark/blur) does not prevent optical capture (external camera). Document compensating controls separately.
• Some GPU/driver combinations can affect capture detection; validate on representative hardware profiles.