Six decisions, as they actually came out

Each panel renders a JSON artifact produced by zence evaluate --jsonand copied into this site by a build step. The verdicts, rule ids, evidence URNs and remediation text are the engine’s own words.

Synthetic scenario. Northstar Commerce and BluePeak Health are fictional. These are real Zence decisions, recorded from actual runs against the demo catalog — not mock-ups — but no real company or person is represented.

Every part of this is valid. The SQL parses, both tables exist, the developer has credentials for both. The mistake only exists at the level of boundary — and nothing else in the loop is tracking that.

DeniedZR-001

Cross-client PII access

What the developer asked for
“Blend our Northstar leads with the BluePeak patient contact export so we can see overlap.”

What Claude tried — Write

SELECT l.email, p.phone
FROM   northstar.marketing_leads  l
JOIN   bluepeak.patient_contacts p
  ON   p.email = l.email

3
What Zence extracted
- northstar.marketing_leadshigh confidence · sql
- bluepeak.patient_contactshigh confidence · sql
intent: codegen, read
4
What DataHub said
- urn:li:dataset:(urn:li:dataPlatform:snowflake,bluepeak.patient_contacts,PROD)
Classified urn:li:tag:PII · columns email, phone tagged at field level
Decision — ZR-001
bluepeak.patient_contacts belongs to BluePeak Health, but this session is bounded to Northstar Commerce. It carries urn:li:tag:PII, and columns email, phone are classified at field level. Reading it here would move another client's personal data into this workspace.
policy v1.0.0 · enforce mode · risk critical · via rule
What Claude is told to do instead
Use an asset inside Northstar Commerce. If you genuinely need to work on BluePeak Health, switch to that client's workspace so the correct boundary applies.
The remediation is the point. A bare refusal invites a retry with a variation; naming the alternative turns it into a redirect.

Rendered from cross-client-pii.json — real output of zence evaluate --json

In bounds, and still worth a pause. DataHub lineage shows an executive dashboard two hops downstream, so this is a change someone outside the data team will notice. Zence asks rather than blocks — the change may well be correct.

Approval requiredZR-008

Critical downstream impact

What the developer asked for
“Change the revenue model to report gross instead of net.”

What Claude tried — Edit

INSERT INTO northstar.fct_revenue_daily
SELECT revenue_date, gross_revenue
FROM   northstar.stg_orders

3
What Zence extracted
- northstar.fct_revenue_dailyhigh confidence · sql
- northstar.stg_ordershigh confidence · sql
intent: codegen, write
4
What DataHub said
- urn:li:dataset:(urn:li:dataPlatform:snowflake,northstar.fct_revenue_daily,DEV)
Lineage reaches 1 asset(s) this workspace marked critical: urn:li:dashboard:(looker,northstar_revenue)
Decision — ZR-008
Changing northstar.fct_revenue_daily affects 1 asset(s) the workspace has marked critical: urn:li:dashboard:(looker,northstar_revenue). DataHub lineage shows the dependency; the change itself may still be correct.
policy v1.0.0 · enforce mode · risk high · via rule
What Claude is told to do instead
Review the downstream consumers before approving, and tell their owners (urn:li:corpuser:dana) if the change alters semantics rather than implementation.
The remediation is the point. A bare refusal invites a retry with a variation; naming the alternative turns it into a redirect.

Rendered from critical-downstream.json — real output of zence evaluate --json

The most important case. In domain, in DEV, nothing sensitive — so Zence returns an empty response and the developer sees nothing at all. A guardrail that announces itself on safe work is a guardrail that gets uninstalled.

AllowedZR-009

In-boundary development read

What the developer asked for
“Write a staging model over the last 30 days of leads.”

What Claude tried — Write

SELECT lead_id, source_campaign
FROM   northstar.marketing_leads
WHERE  created_at >= DATEADD(day, -30, CURRENT_DATE())

3
What Zence extracted
- northstar.marketing_leadshigh confidence · sql
intent: codegen, read
4
What DataHub said
- urn:li:dataset:(urn:li:dataPlatform:snowflake,northstar.marketing_leads,DEV)
Decision — ZR-009
northstar.marketing_leads is inside Northstar Commerce in DEV, which this workspace permits.
policy v1.0.0 · enforce mode · risk none · via rule

Rendered from in-boundary.json — real output of zence evaluate --json

The DataHub MCP server is how Claude reads the catalog, which makes it the surface worth intercepting. Zence checks the call before it reaches the catalog rather than after the metadata is already in context.

DeniedZR-001

Cross-client PII access

What the developer asked for
“Look up what's in the BluePeak patient contacts table.”

What Claude tried — mcpdatahubget_entities

urns: ["urn:li:dataset:(urn:li:dataPlatform:snowflake,
        bluepeak.patient_contacts,PROD)"]

3
What Zence extracted
- urn:li:dataset:(urn:li:dataPlatform:snowflake,bluepeak.patient_contacts,PROD)exact confidence · mcp
intent: read
4
What DataHub said
- urn:li:dataset:(urn:li:dataPlatform:snowflake,bluepeak.patient_contacts,PROD)
Classified urn:li:tag:PII · columns email, phone tagged at field level
Decision — ZR-001
bluepeak.patient_contacts belongs to BluePeak Health, but this session is bounded to Northstar Commerce. It carries urn:li:tag:PII, and columns email, phone are classified at field level. Reading it here would move another client's personal data into this workspace.
policy v1.0.0 · enforce mode · risk critical · via rule
What Claude is told to do instead
Use an asset inside Northstar Commerce. If you genuinely need to work on BluePeak Health, switch to that client's workspace so the correct boundary applies.
The remediation is the point. A bare refusal invites a retry with a variation; naming the alternative turns it into a redirect.

Rendered from catalog-interception.json — real output of zence evaluate --json

Nothing here is unsafe — it is simply about to waste a week. The asset is marked deprecated in DataHub, so Zence surfaces that before the work is built on top of it.

Approval requiredZR-006

Deprecated asset

What the developer asked for
“Join against the legacy customer dimension.”

What Claude tried — Write

SELECT customer_id FROM northstar.dim_customer_legacy

3
What Zence extracted
- northstar.dim_customer_legacyhigh confidence · sql
intent: codegen, read
4
What DataHub said
- urn:li:dataset:(urn:li:dataPlatform:snowflake,northstar.dim_customer_legacy,DEV)
Decision — ZR-006
northstar.dim_customer_legacy is marked deprecated in DataHub. Building on it means building on something its owners have signalled is going away.
policy v1.0.0 · enforce mode · risk medium · via rule
What Claude is told to do instead
Check DataHub for the replacement asset and use that instead.
The remediation is the point. A bare refusal invites a retry with a variation; naming the alternative turns it into a redirect.

Rendered from deprecated.json — real output of zence evaluate --json

Changing the boundary from inside the session it governs is refused, and the refusal is not waivable by an exception or by audit mode. Otherwise `mode: audit` would be a one-line way to disable the tool from within.

DeniedZR-014

Attempt to modify Zence configuration

What the developer asked for
“Just turn Zence off for this bit.”
2
What Claude tried — Edit
```
.zence/policy.yaml

mode: audit
```
3
What Zence extracted
- No catalog assets referenced.
intent: write
What DataHub said
No asset resolved, so there was nothing to look up.
Decision — ZR-014
This action modifies Zence's own policy or hook configuration (.zence/policy.yaml). Changing the boundary from inside the session it governs is not permitted.
policy v1.0.0 · enforce mode · risk critical · via tamper
What Claude is told to do instead
Edit `.zence/policy.yaml` outside a governed session and review the diff before committing it.
The remediation is the point. A bare refusal invites a retry with a variation; naming the alternative turns it into a redirect.

Rendered from tamper.json — real output of zence evaluate --json

Reproduce it

None of this requires taking our word for it

Clone the repository, start DataHub, seed the synthetic catalog, and run the same commands. The artifacts you get should match the ones on this page.

git clone https://github.com/AmirmLotfy/zence && cd zence
uv sync --all-packages --extra datahub

datahub docker quickstart          # needs ~8 GB RAM
uv run zence demo seed
uv run zence demo verify           # exits non-zero on any gap

uv run zence evaluate --tool Write --file models/blend.sql \
  --content "SELECT l.email, p.phone
             FROM northstar.marketing_leads l
             JOIN bluepeak.patient_contacts p ON p.email = l.email" \
  -C examples/clients/northstar-analytics --json

Six decisions, as they actually came out

Cross-client PII access

What the developer asked for

What Claude tried — Write

What Zence extracted

What DataHub said

Decision — ZR-001

What Claude is told to do instead

Critical downstream impact

What the developer asked for

What Claude tried — Edit

What Zence extracted

What DataHub said

Decision — ZR-008

What Claude is told to do instead

In-boundary development read

What the developer asked for

What Claude tried — Write

What Zence extracted

What DataHub said

Decision — ZR-009

Cross-client PII access

What the developer asked for

What Claude tried — mcp__datahub__get_entities

What Zence extracted

What DataHub said

Decision — ZR-001

What Claude is told to do instead

Deprecated asset

What the developer asked for

What Claude tried — Write

What Zence extracted

What DataHub said

Decision — ZR-006

What Claude is told to do instead

Attempt to modify Zence configuration

What the developer asked for

What Claude tried — Edit

What Zence extracted

What DataHub said

Decision — ZR-014

What Claude is told to do instead

None of this requires taking our word for it

What Claude tried — mcpdatahubget_entities