Detector capability roadmap after the HPI-I/VSN micro-slice

Status: proposal for review. This is planning only and changes no runtime code, contract, or policy. As of: 3 October 2026 Machine-readable matrix: research/detector-capability-matrix.json (89 rows). It maps every inventory identifier and every AU.BANK.* capability to a row.

The matrix is a snapshot, not a complete catalogue. New candidates enter as proposed rows. Rejected rows stay in the matrix so excluded ideas are not re-proposed without new evidence. IDs, categories, and packages follow ADR 0010 and the proposed ADR 0011. They stay provisional until the ADR 0011 ID grammar and public taxonomy are approved.

BaselineCopy Anchor Link

The approved micro-slice has two detectors: HPI-I (validated_structured) and exact-labelled VSN (context_bound_structured). They are specified in the micro-slice record and shipped as experimental built-ins builtin.pii.au.hpi-i and builtin.pii.au-vic.vsn (version 0.1.0). Both are disabled by default (G0) and run only under the observe or redact-experimental profiles of au-baseline.yaml.

The roadmap assumes the slice delivers three reusable pieces:

• the Luhn validator and boundary rules;
• the label/field binding engine;
• detector-scoped finding IDs and overlap handling.

Ranked next detectorsCopy Anchor Link

Each candidate is scored 1–5 on five criteria:

• value: the harm it prevents;
• source: whether an authoritative grammar or checksum exists today;
• precision: how deterministic it is;
• reuse: how much micro-slice machinery it shares;
• readiness: whether any legal, licence, runtime, or governance blocker remains.

Ties go to readiness. Nothing that needs a model runtime or a new contract is ranked.

Next wave (unranked):

• HPI-O;
• AU phone, IP address, MRZ, and labelled date of birth;
• CRN, USI, ImmiCard, Visa Grant Number, DVA, NSW WWCC, and VIN (label-gated);
• operator canary-token leakage, which generalises the existing TEST_SECRET_CANARY check;
• output exfiltration URLs;
• PSPF protective markings, ranked by government-tenant demand;
• JWT, connection strings, and secrets provider batch 2.

IHI evaluationCopy Anchor Link

IHI is ranked first.

Why it ranks first:

• Low engineering cost. It uses the HL7 AU Base profile (CC0): 16 digits, prefix 800360, and Luhn. The HPI-I validator, boundaries, surface forms, and evidence model carry over unchanged. It belongs in the same health-identifiers.yaml family.
• High harm. It identifies patients and is restricted by HI Act s 26.
• Low false-positive risk. Random 16-digit text passes about 1 in 10⁷ times. Context changes evidence, never state.

The real cost is fixture risk. Tens of millions of IHIs are issued in a space of about 10⁹ Luhn-valid values, so a synthetic checksum-valid IHI has roughly a few per cent chance of being a real patient's number. HPI-I's chance is about 0.1%.

Privacy must approve these mitigations before specification:

• keep the number of distinct values minimal;
• prefer published standard examples;
• never pair a value with names, dates of birth, or providers;
• label every value as synthetic;
• keep values out of telemetry;
• generate the private holdout outside Git.

HPI-O should follow cheaply, but record-only: it is an organisational identifier.

Parallel tracks (not in the ranked list)Copy Anchor Link

Deterministic action/mandate evaluators. These are policy evaluators, not content detectors. They all need a typed, authenticated action envelope, which today's evaluation request and trusted context do not carry.

The plan places these in Phase 3. The banking research calls them the product wedge, so deciding the envelope ADR earlier is the main lever.

Model-backed detectors (Phase 5). These are integrated, not built:

• prompt-injection/jailbreak classifiers (Prompt Guard 2, ProtectAI v2, Granite Guardian);
• content-safety classifiers;
• person-name NER;
• banking conduct signals: complaint, hardship, scam coercion, advice boundary.

Run an offline benchmark spike in the Python harness now. Production use waits for:

• a runtime decision (OD-007/OD-021);
• model licence approval (the Llama licence is not OSI-permissive);
• self-hosting for sensitive traffic (OD-008).

Conduct and safety classifiers are route_or_friction_only: they can warn, clarify, or route, but never make the sole adverse decision.

Defer and rejectCopy Anchor Link

Decisions neededCopy Anchor Link

1. Approve the ranked order, in particular whether secrets (ranks 2–4) interleave with Australian identifiers.
2. Privacy approval for IHI fixture handling.
3. Whether ADR 0010's validation state and class semantics extend to non-Australian structured values (payment card, MRZ, checksum tokens), or whether ADR 0010 needs an amendment.
4. Medicare source: obtain and licence-check the ADHA conformance material, or keep Medicare context-bound.
5. New category roots (data., action., banking., conduct.) and packages (data-handling, agent-actions, banking-au).
6. Whether to bring the action-envelope ADR forward.
7. The model-runtime path and model licence policy (OD-007/OD-021).
8. Package owners for secrets, security-prompt, and data-handling (ADR 0011 decision 6).

Maintaining the matrixCopy Anchor Link

• Edit a row's maturity as it moves from proposed through enforceable.
• Add sources before claims: external sources marked verified_in_this_review: false must be revalidated at specification.
• Never reuse an ID.
• Once ADR 0011 is approved, specified rows move into catalog/packages/groundskeeper.dev/*. The matrix then becomes a generated view rather than a source.