feat: masking of PII - #71
Merged
Merged
Conversation
schiwekM
added this pull request to stack #115
September 12, 2026 12:14
Akatuoro
reviewed
Sep 16, 2026
Akatuoro
left a comment
Akatuoro
left a comment
Contributor
There was a problem hiding this comment.
Just a first pass:
- The masking map should not be managed in its own table...
- There are way too many
scrubForTrace, we should have the tool call result always directly in the usable form
Two ideas:
- Since this is about masking for the LLM, only do masking in wrapModelCall, or
- Mask directly in the tool result and resolve only when calling another tool or when sending something to the user
The first one seems much cleaner to me while still fulfilling the core goal.
Akatuoro
approved these changes
Sep 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Mask PII properties returned from queries, actions and functions so the LLM works with hashes and not the actual PII.
Masked values are shown in traces, actual values are injected for the hashes when the message is returned to the user.
The hashing is seeded for each conversation, to ensure that LLMs cannot infer relations between PII across sessions.
Masking of AI Core is not enabled because it has larger performance impact and when we mask the initial user input and tool results we do not need the AI Core masking, thus leading to a better performance.
Have you...