promptdojo_

The PII proxy — mask before the model, unmask for the named human — step 2 of 8

ch 55 · ops studio2/8

Mask, then unmask

Run the code. That's tonight's exception ticket as a string — and the loop just took every known identifier out of the outbound payload.

Walk the fields:

  • PII — the values this ticket is allowed to tokenize, in order. kind becomes the token stem (member → MEMBER). The number is the 1-based index in this list, not a global counter. [MEMBER_1] on this ticket is not a promise about any other ticket.
  • token_map — the receipt. Token to real value. Without it, unmasking is guessing. With it, restoration is a replace loop, same as the mask loop run backwards.
  • KNOWN — what must never appear in the outbound text, even if someone forgot to put it on PII. The token map is what you think you masked. The leftover check is what you already know is an identifier. Two lists, on purpose — the same split you used for source vs verified on an SOP step.
layersees
outbound, to the modeltokens only — [MEMBER_1], [EMAIL_2], [PHONE_3]
leftover checkany KNOWN value still sitting in that outbound string
restore, for the named humanthe real member ID, email, and phone, written back from the map

Now look at what printed. The outbound line has no clinic email, no callback number, no member ID. The leftover line says none. The map still holds the real values — they did not disappear; they moved to a side channel the model never gets.

Why a proxy and not a memo

Because a memo can only be remembered, and remembering is exactly the review that fails at 7pm on a desk with twenty open exceptions. Data can be linted:

  • known value still in the outbound string → blocked, mechanically, every time, including the ticket someone "just needed a quick draft on."
  • No named reviewer → blocked. auto is not a reviewer.
  • Later: unmask into a vendor log → blocked. Same lint, one more destination.

The one thing the leftover check can't do is discover identifiers you never listed. KNOWN is only as good as the catalog you maintain — emails, phones, member IDs, the shapes that already live in your member file. The machine enforces that those values did not leave. A human still owns the catalog.

Next: you play the send-path reviewer, reading four payloads against the leftover rule.