promptdojo_

The PII proxy — mask before the model, unmask for the named human — step 6 of 8

ch 55 · ops studio6/8

Unmask is a named-human act

You just watched a draft come back as tokens and leave as a member email, a phone, and a member ID. That restore step is the whole second half of the proxy, and it has the same shape as the checklist line from earlier in the chapter: the machine may compute; a named human holds what binds the company.

Here the thing that binds is not a forklift inspection or an OSHA posting. It is the identifiers themselves. Once they are written back, they are in someone's hands — on a screen, in a send box, in a thread a lawyer can ask about. auto is not a pair of hands. A vendor log is not a pair of hands. Unmasking into either is the original paste, with a token map as an alibi.

So the restore path gets classified, on purpose, before it runs:

  • Named human — Vera, Miguel, whoever owns the exception reply. The map runs. The real values appear in front of that person. They send, or they don't.
  • Anyone else — auto, a log line, a "send the draft back to the vendor for a second pass." The map does not run. The draft stays tokenized, or the whole ticket blocks. Tokens can travel. Real values stop at a name.

The leftover check is not optional just because the reviewer is named

A named human on a raw outbound is not a proxy. That is someone reading the leak after it already left. The leftover check runs on what the model would see, and it runs first. Only a clean outbound gets as far as the reviewer question. Two gates, in that order:

  1. Any known identifier still in the outbound string → refuse the send. The model never sees it.
  2. No named reviewer (missing, or auto) → refuse the restore. The real values never come back.

You have seen this division all chapter: the machine enforces that the check happened; the human is the check. The leftover list is the machine. The name on the restore is the human.

HIPAA and SOC 2 are still just the reason anyone funded this. They do not write the function. Next two steps: you build the proxy, then the gate that prints both sides — what left for the model, and who (if anyone) got the real values back.