The Check logs the decision, not the customer

The Check runs your rules on a prompt before it goes anywhere. Every result is logged in Activity, so you can show what was checked and what happened.

That log shouldn't hold customer data. Names, email addresses, phone numbers, street addresses, account and order numbers, and payment details are replaced with labels before a check is logged. Activity shows what kind of detail was removed, not the detail itself.

By default, the Check never calls a model. Some rules need judgment, like "never promise a delivery date." An owner can turn on meaning reads for rules like that. A model then reads the prompt, with customer details already replaced. Who turned it on, and when, is logged.

HELD still names the rule and the date it was set. Anyone can still override it, and the override is logged.