Thomas,

If this was to work for email (and API interfaces), would you expect
to see the default value in an auditor or just in a detector?

My thought is:

  in web interface the user can see the default value and choose
    something different. So in the auditor we can see that the user
    chose the default value.

  in email or api/rest interfaces the user can't see the default
    so the auditor doesn't see the default value either.

however detectors see all values: user set and set by default. This way 
detectors can report all values.

Sensible??