Before you begin
Use an enrolled managed device, approved endpoint policy and administrator-approved test folder or clipboard content. The Windows endpoint components are outside the proposed first browser pilot unless separately scoped.
- Choose a synthetic value and an authorized test machine.
- Identify the exact sensor and operating-system profile offered for this release.
Supported scope and current status
Governs measured submission paths on supported origins in enrolled Chrome profiles, observes text clipboard generations on enrolled Windows devices, and watches activity in configured sync roots. Clipboard replacement or clearing is bound to the exact current generation; the observer does not know which application, destination or paste action may consume it, and cannot prove another application did not read the original first. Every decision a device reports is rechecked centrally, and any that does not match your policy is rejected.
- Map each requested action to /coverage.
- Distinguish observation from pre-send prevention.
Compare this path with the published coverage table and the coverage guide.
Set up the path
Coordinate device admission and endpoint package assignment with your management administrator. Configure only approved paths and sync roots and read back policy adoption before using the device for a protected workflow.
- Confirm device identity and sensor health.
- Keep a documented rollback assignment for this cohort.
Use the workflow
Exercise one supported path with synthetic data, then observe the endpoint decision and the next system’s actual result. For clipboard tests, use the current generation and do not infer where a later paste went.
- Run a clean control action and a sensitive synthetic action.
- Record whether the exact source generation changed or remained untouched.
Verify the result
Read back the central policy decision and the device’s current state. A reported decision that conflicts with the approved policy must be rejected; an event without downstream observation does not prove prevention.
- Match policy revision, device and action.
- Verify the target effect independently where a preflight control is supported.
Coverage references: 9 requirements, 0 currently passed
This guide is bound to 9 requirements in RedactWall's acceptance crosswalk, which is maintained internally and not published. A requirement counts as passed here only after current evidence for every bound scenario and authority has been published; none has been published yet.
See the public verification overview and the documentation coverage guide.
Denials and recovery
An offline or stale endpoint is not a healthy empty device. Stop expansion, retain the last approved policy and ask the endpoint administrator to restore a current report before re-testing.
- Use non-sensitive health and time details for support.
- Repeat the synthetic test after installation or policy rollback.
For customer-side next steps, read Recovery and support.
Billing and integration handoffs
The endpoint agent and browser sensor on one managed machine share one seat. Sync-root, browser and gateway integrations require their own configured paths and may have different behavior.
- Check admitted capacity before adding devices.
- Confirm any cloud-drive connector separately; local sync observation is not cloud remediation.
Limits to keep in view
Do not claim that clipboard observation blocks all pastes, that all local files are protected, or that a device sensor covers every destination. The proposed first pilot excludes these endpoint components.
- Use release-specific supported-profile evidence.
- Keep unknown or bypassed applications in the report.
Review the current Disclosures before relying on a capability.