AONA / FICTIONAL REPORT EXAMPLE
Employee AI security review
11 August to 9 September 2026, inclusive (30 calendar days) / Finance and Operations
Fictional example. Every record in this review is invented. The report is not an Aona export, customer result, installed-client measurement or compliance verdict.
Review scope
- Population
- 20 invented policy interactions across two fictional teams
- Period
- 11 August to 9 September 2026, inclusive
- Denominator for outcome rates
- 20 evaluated interactions
- Team split
- 10 Finance and 10 Operations interactions
An evaluated interaction has a non-null policy action other than NO_POLICY. This sample contains no NO_POLICY, FLAG or missing-action rows. The denominator is interactions, not employees, uploads or all AI activity.
Outcome summary
| Policy action family | Finance | Operations | Total | Share of 20 |
|---|---|---|---|---|
| Compliant | 6 | 6 | 12 | 60% |
| Redacted | 2 | 2 | 4 | 20% |
| Blocked | 1 | 2 | 3 | 15% |
| Warned | 1 | 0 | 1 | 5% |
| Total evaluated | 10 | 10 | 20 | 100% |
The redacted family in Aona's metrics definition includes AUTO_REDACT, REDACT, MANUAL_REDACT, AUTO_UPDATE and MANUAL_UPDATE. This teaching ledger uses AUTO_REDACT only. A public events API view excludes compliant records, so these 20 invented rows must not be read as 20 API events.
Fields in the synthetic ledger
| Field | Meaning in this example |
|---|---|
| sample_id | Unique invented row identifier. |
| timestamp_utc | Illustrative interaction time in UTC, within the stated 30-day window. |
| team | Fictional Finance or Operations group used for the comparison. |
| ai_service and input_type | Generic example service and illustrative typed prompt or file upload route. Neither field asserts tested Aona coverage. |
| data_category | Invented category for the selected example action; no raw prompt or file content is included. |
| policy_action and fictional | The sample outcome code and a yes flag that keeps every row explicitly fictional. |
What a reviewer would decide next
- Inspect the three blocked examples and confirm whether those fictional workflows match the intended policy.
- Review the four redacted examples for document usability and any information still visible.
- Record client installation, app route, policy version and event evidence during a real pilot before interpreting a customer result.
The invented ledger cannot establish deployment coverage, detection quality, prevented leakage or compliance. Those require current evidence from the selected customer route.