Concepts
The risk-axis model
PayloadGlass does not reduce a file to a single “malicious / clean” number. Risk depends on what you are about to do with the content — open it, index it into a RAG corpus, forward it externally, hand it to an agent. So the engine reads five orthogonal axes over one evidence graph. One artefact routinely scores on several at once.
The five axes
| Axis | Question it answers | Examples |
|---|---|---|
| Hostility | Could this content harm a system, user, or agent by executing, exploiting, fetching, evading, or chaining behaviour? | JS/macros, LNK, SVG smuggling, exploit primitives, droppers |
| Deception | Does this content manipulate a human into an unsafe action? | QR phishing, fake login, ClickFix, brand impersonation |
| AI-ingestion | Could this content corrupt or manipulate an AI/RAG/agent workflow? | hidden prompts, retrieval-visible instructions, tool-use directives |
| Sensitivity | Would exposure, indexing, retention, or sharing of this content cause harm? | secrets, credentials, PII, regulated or confidential data |
| Provenance | Does origin, custody, or trust context increase risk? | MOTW loss, external sender, unauthenticated source |
The axes are disjoint by question, not by evidence — the same finding can inform several axes.
Two disciplines that keep it trustworthy
Three lenses drive the verdict; two are advisory. The malicious / suspicious / benign label is the worst of just hostility, deception, and
AI-ingestion. Sensitivity and provenance are advisory governance
lenses that never feed the threat score — so a document full of secrets is
not thereby “malicious,” and a phishing lure is not hidden behind a low
sensitivity reading. workflow_action folds into AI-ingestion as a sub-signal;
cdr_residual is a meta-lens that reads Unknown until a sanitise + verify-rescan
runs.
Governance is a derived projection, not an axis. “Is this safe to open / index / forward / send to an agent?” is computed from the axes’ evidence plus coverage, provenance, destination, and the active policy profile — it is destination-aware (safe to open locally ≠ safe to index in RAG ≠ safe to forward externally). Detectors produce evidence; policy — not the detector — decides.
What ships today vs. what’s on the roadmap
The secret and PII detection that feeds the sensitivity lens ships today:
evidence-safe (raw secrets are never emitted) and verdict-inert. Sensitivity
is advisory — it gates nothing yet. Provenance reads Unknown on a bare scan
until a host connector supplies origin facts (mark-of-the-web, sender, custody);
that connector is a roadmap item, and is distinct from the tamper-forensic
findings (revision overlays, date and producer contradictions), which do ship.
The destination-aware governance layer (the safe_to_* projections and the
enforcing gateway decisions) is on the roadmap.
What this is not
- Not DLP. Sensitivity is one intrinsic axis with policy projections over it — not a per-jurisdiction regulated-content library.
safe_to_indexis notai_ingestion_risk. Ingestion risk is about hostile or poisoned content reaching a model; it does not promise indexing quality.- Governance never rescoring threat. The gateway acts on projections; it does not fold sensitivity back into the malware score.