fair question. not super high unless it is enforced in architecture, not policy docs. in our case confidence was high only after 3 controls were hard-wired: telemetry-only schemas, gateway-level payload stripping, and audit logs that fail closed when raw payload fields appear. without those, i'd assume drift over time.