Redact before the model call, not after

The pattern we keep finding

Teams adding AI to a support or operations workflow usually start by sending the whole record to the model, then filtering what comes back. The filter catches names and email addresses in the response, the demo looks clean, and the review passes.

The problem is that the filter is on the wrong side. Whatever was in the prompt has already been transmitted, logged by the provider, and possibly retained under a policy nobody on the team has read. Cleaning the response protects the person reading the output, not the person whose data it was.

What is actually in a support thread

We audited a sample of tickets to find out what a naive prompt would carry. Names and email addresses, obviously. But also: pasted log excerpts containing bearer tokens, internal hostnames, a screenshot filename with a customer's full legal name, and in one case an entire database connection string a user had included while asking why a sync failed.

None of that is exotic. It is what happens when you ask people to describe a technical problem: they paste the evidence. Any design that assumes prompts contain only prose is assuming something about user behaviour that is not true.

Typed placeholders, mapping held locally

Redaction now runs before the prompt is assembled. Names, addresses, phone numbers, and anything matching a credential pattern are replaced with typed placeholders — the type matters, because a model reasons differently about a person's name than about an account number, and replacing both with a bare token degrades the output.

The mapping from placeholder to original value stays in your tenancy. The response comes back with placeholders and is rehydrated locally, so a reply reaches the customer with their real name in it while the model never received it.

This is not free. Redaction costs latency, the patterns need maintenance, and an aggressive filter can strip context the model needed. We think that is the correct trade to make explicitly rather than discovering the alternative during a vendor-risk questionnaire.