The Data Ingestion Audit Agent operates at the input boundary of the pipeline. Before any Navigator-supplied data enters agent processing, DIAA scans it against two pattern sets: universal patterns that fire regardless of industry, and industry-specific patterns loaded from the active industry's compliance rule set.
Universal Detection Patterns (All Industries)
These 8 patterns fire on every session regardless of which industry is detected:
- SSN patterns — numeric sequences matching ###-##-#### format
- Credit card patterns — 16-digit sequences matching Luhn algorithm
- Classified document markings — TOP SECRET, SECRET, CONFIDENTIAL, CUI, NOFORN, FOUO
- ITAR/EAR indicators — USML category references, ECCN codes, export license numbers
- API keys and credentials — bearer tokens, OAuth secrets, private key headers
- MNPI language patterns — unannounced earnings, pending acquisition language
- PHI combination patterns — personal identifiers combined with medical or clinical terms
- Attorney-client markers — privilege language combined with matter identifiers
Industry-Specific Patterns
Beyond the 8 universal patterns, each industry carries its own detection rules. There are 49 industry-specific patterns across all 14 industries. Each pattern is a structured, executable object — not prose guidance. Each carries an ID, description, type, keyword list or regex, context requirements, proximity window, flag category, and severity level.
Pattern types in use: keyword_proximity (keyword present within N words of a context marker), regex (direct pattern match), keyword_list (any keyword triggers flag), pattern_combination (multiple signals required together), and structural_scan (document structure analysis for classified headers).
What Happens When DIAA Flags Something
When DIAA identifies a prohibited data pattern, it executes a four-step sequence:
- Hold — The flagged data is withheld from the pipeline. Processing does not continue with flagged content.
- Notify — The Navigator receives a plain-language notice identifying the flag category and the action required. No rule citations. No agent names.
- Log — The flag event is written to the session compliance audit log: timestamp, session ID, flag category, industry, stage, action taken. The flagged content itself is never logged.
- Offer — The Navigator is offered three options: remove or redact and resubmit, proceed without the flagged source, or abort the session.
Zero Data Retention on Every Flag
When DIAA flags prohibited content, that content is discarded immediately. The audit log records the event but never the content itself. content_logged is hardcoded to false in the audit log schema. This is not configurable. It is not a policy setting. It is an architectural constraint.