PCI Baseline

Version

1.0.0

Category

Data boundaries

Evaluation Available

true

Domains

• HIPAA_PHI
• PCI
• SECURITY

Controls

• Email, phone, SSN, MRN-like and card-number patterns
• Six normalized instruction-override phrase heuristics
• Structured credential fields and known secret patterns

Docs

• Policies and validators
• Policy packs
• API reference

Thresholds

warn: 1

redact: 3

block: 6

escalate: 12

Behavior

• The exact assigned ID and version select scoring weights, thresholds and enabled validators.
• BLOCKED and ESCALATE_HITL withhold protected output. Required transformations are applied and revalidated at supported boundaries.
• PCI findings have domain weight 3; SECURITY findings have weight 2. Card detection is a digit-pattern heuristic, not payment authorization or a card-validity service.

Limitations

• Pattern matching can produce false positives and miss sensitive data; it does not establish legal data classification.
• Pack names do not establish HIPAA, PCI DSS, accessibility or other regulatory compliance.
• A finding is not a completed remediation. Inspect the final enforcement outcome and returned artifact.
• Regulatory Pulse source coverage and draft state mappings do not establish installed jurisdiction-specific executable packs.
• Does not assess the cardholder-data environment, PCI DSS requirements, network segmentation or payment-provider certification.

Enabled validators

• pii-phi · 1.1.1
• prompt-injection · 1.2.0
• security-secrets · 1.1.0

Bounded examples

Request examples describe an exercise; they are not recorded execution evidence.

{"payload":{"example":"4111 1111 1111 1111"}}