Personal data (PII)
Configuration, evaluation scope, and practical limits for pii_detection.
pii_detection is the policy type used by the API and policy editor.
What it checks
Inspects submitted input and output for personal identifiers. The optional health-data setting adds clinical-identifier checks where available.
Configure the policy
Create a policy under Dashboard → Security → Policies. Choose this policy type, set the agent scope, and start in warning mode while you measure results. Use blocking only after verifying the application’s decision gate.
The following is the config object, not a complete policy-creation request:
{
"hipaa_mode": false,
"structured_identifiers": false
}Scope and limits
Sensitivity is configured per check; a single setting does not control every result. Contact support for deployment-specific guidance before changing advanced sensitivity settings. HIPAA mode does not establish HIPAA compliance. Limited detector availability can produce a degraded check. The current implementation inspects at most the first 5,000 characters of each text. A generic entities option is not a universal entity filter in this implementation.
Enable structured_identifiers deliberately to add structured payment-card and spoken-identifier checks. These checks report structural matches; they do not validate account ownership. Test relevant languages, formats, false positives and long inputs before rollout.
Verify before rollout
Test a representative safe input, a synthetic positive case, and an unavailable-detector case. Inspect evaluation_status, errors, policies_evaluated, findings and allowed. A clean empty finding list is useful only when the required checks completed.
The policy mode determines the decision: warning findings can coexist with allowed: true. Your application must act on a blocking decision before the protected operation. Evaluation does not automatically redact text or cancel an operation that already happened.