pii

This code runs on every single response, so it sits on the critical path and a heavyweight check here doubles your p95. The signal is in the ordering, the fail-open decision when the guardrail times out, and the fact that you cannot un-send a token you already streamed.

A CISO-facing question that trips up engineers who focus only on model quality. What matters is treating governance as architecture rather than a checkbox: minimization, isolation, auditability, and never training on customer data by default. Here is the framework.

Because detection never catches everything, the strong answer works in layers: checksummed regex for structured PII, ML/NER for the unstructured PII regex misses, and an honest explanation of why redaction alone is never enough. Here is the answer.

LLM apps bleed secrets in three quiet places: the prompt, the logs, and the next training set. Each demands a different control. Here is how to close all three.