jcoffey-dev
2a851ea230
Phase 1: one native rule engine at DATA, after the system Sieve script, for both DLP policies and transport rules. DLP checks outgoing mail with counted detectors (payment cards, IBAN, US SSN, word lists, patterns) and blocks, warns with an audited override, or holds for review. Held mail stays in the queue unscheduled, with its own review record, so the queue's stored format is unchanged. Matches go to the audit log without the matched text. Six questions for John at the end.