{
  "leak_id": "ae041aca-23c3-46a6-b026-b988a8a38c3d",
  "generated_at": "2026-08-31T03:55:50Z",
  "document_name": "FNB_Compliance_Audit_2025.xlsx",
  "matched_user": {
    "user_id": "FNB-U1090",
    "name": "Michael Torres",
    "email": "michael.torres@fnbank.com",
    "department": "Compliance"
  },
  "watermark_id": "b2cca624-ca75-4e71-9579-f6bd21794c63",
  "issued_at": "2026-07-29T03:15:00Z",
  "detected_at": "2026-08-25T03:15:00Z",
  "detected_by": "Endpoint agent telemetry",
  "recovery_channel": "Unmanaged endpoint copy",
  "confidence": 98.8,
  "algorithm": "ML-DSA-87",
  "signature_bytes": 4627,
  "signature_snippet": "AXnp1wbJWXK+VndrHaYYUfSWlQsBgjo2...",
  "verification": "VALID",
  "status": "UNDER_REVIEW",
  "chain_of_custody": [
    {
      "at": "2026-07-29T03:15:00Z",
      "event": "Watermark issued",
      "detail": "Payload bound to michael.torres@fnbank.com and signed with ML-DSA-87."
    },
    {
      "at": "2026-07-29T03:19:00Z",
      "event": "Document released",
      "detail": "Copy delivered to recipient through the managed document portal."
    },
    {
      "at": "2026-08-25T03:15:00Z",
      "event": "Leak observed",
      "detail": "Copy recovered from: Unmanaged endpoint copy."
    },
    {
      "at": "2026-08-25T03:17:00Z",
      "event": "Watermark extracted",
      "detail": "Embedded payload recovered at 98.8% confidence."
    },
    {
      "at": "2026-08-25T03:18:00Z",
      "event": "Signature verified",
      "detail": "ML-DSA-87 verification returned VALID against the issuance ledger."
    }
  ],
  "simulated": true,
  "product": "QMark — Primum & Terminus"
}