For compliance and security
What each role can see or do beyond its rights, verified before it is raised.
Permission findings
A persona signs in with one role and the reviewer checks what that role could reach. This finding is from run 2026-10-17-lin-contributor-008, tagged code because the reviewer confirmed it in the source. Every blocker or major finding waits for a person before it counts.
What leaves your environment
Goes to your OpenTelemetry backend
- Run, batch, persona and scenario IDs
- Outcome, target environment and commit
- Page URLs and HTTP statuses
- Model, region, tokens and cost
- Finding title, kind, severity, evidence tag and verdict
Stays with the run record
- Screenshots
- Page text
- The persona's notes on each step
- Console and network bodies
- Test-user credentials and provider keys, which are never recorded
The run record and its screenshots stay wherever you run Dummy Run. The exporter sends a subset to the OpenTelemetry backend you choose. If a preview puts personal data in a URL, that URL reaches the backend, so keep previews on synthetic data.
In region
- europe-west2 London
- uksouth London
- ukwest Cardiff
- global
A market profile lists the regions that satisfy it and a run refuses to start if any adapter cannot. Personas are fictional, and the contributing rules bar real names, contact details and data from a target environment. Security explains coordinated disclosure for Dummy Run itself.
Sources
The confirmation rule and the residency rule are in the architecture, sourced. The exported attributes are in Telemetry, sourced. The run above is a synthetic example in examples/runs/, measured.