PII redaction for agent-visible query results

TL;DR

Redact before the agent ever sees the data URIs put a masked view or a masking policy between the agent and the raw tables, and grant the agent access to the masked layer only. Redacting in the agent's instructions is not redaction, it is a hope. It works because the masking lives in the database: even a clever prompt cannot reach values the query layer never returns.

PII redaction for agent-visible query results

Use this when

• Agents query tables that contain PII
• Agent query results get logged, cached, or repeated back
• Compliance requires minimized exposure of personal data
• You cannot vouch for every downstream system the agent touches

Not for

• Replacing schema scoping, which controls which tables are visible at all
• Free-text PII buried in notes fields, which needs detection first
• Cases where the agent legitimately needs raw values for an approved purpose

Steps

1. Inventory which columns are PII and what each needs:

SELECT table_schema, table_name, column_name
FROM ops.pii_inventory
WHERE classification IN ('email', 'phone', 'name', 'address')
ORDER BY 1, 2, 3;

Expected output: the definitive list of columns to mask. If a column is not in the inventory, it is not masked, so the inventory is the control plane.

2. Build masked views the agent will query instead of raw tables:

CREATE VIEW reporting.customers_masked AS
SELECT
  id,
  sha2(email, 256) AS email_hash,
  regexp_replace(phone, '.', '*', 1, length(phone) - 4) AS phone_masked,
  city, signup_date
FROM raw.customers;

Expected output: a view with joinable hashes where joins need keys, and masked values where humans would read them. The raw email and phone never leave the database.

3. Grant the agent the views and nothing else:

GRANT SELECT ON reporting.customers_masked TO ROLE agent_reader;
-- the agent has no grant on raw.customers at all

Expected output: the agent's queries against the masked view succeed and any attempt to reach the raw table fails with permission denied.

4. Verify what the agent actually sees with a probe query:

SET ROLE agent_reader;
SELECT email_hash, phone_masked, city FROM reporting.customers_masked LIMIT 3;
-- expected: hashes like 9f2c..., phones like ********1234, real city names

Expected output: masked values in every sensitive column. If anything raw shows up, the view definition has a leak; fix the view, not the agent.

5. Log access to the masked layer like any sensitive data URIs

INSERT INTO ops.pii_access_log (who, what_view, queried_at)
VALUES ('agent-7', 'reporting.customers_masked', CURRENT_TIMESTAMP);

Expected output: an access record per agent session. Masked is not the same as non-sensitive, and the log proves you treated it that way.

Variant phrasings

mask PII from AI agent queries

Masking at the view layer is the mechanism. Anything the agent does downstream, logging, summarizing, caching, then operates on already-masked data.

data masking for LLM database access

Partial masking (last-four phone digits) preserves utility for analysis while hiding identity. Full hashing preserves joinability while hiding everything.

hide sensitive columns from agent

Hiding means no grant, not SELECT with instructions to ignore. A column the agent cannot select cannot leak.

Why it happens

Agents repeat what they read: into logs, into summaries, into follow-up questions, into other tools. Every repetition is another copy of the PII outside your control. Masking at the database layer breaks this chain at the source, because the agent never possesses the raw value in the first place. Instruction-based redaction fails the moment the agent is confused, tricked, or simply verbose, and you will not know it happened until the PII is already in a log somewhere.

Edge cases

• Join keys on PII: hash both sides with the same function so joins still work on hashed values.
• Free-text fields can contain PII no column inventory catches; run a PII detector over text columns before deciding the masked view is sufficient.
• Re-identification: city plus signup date plus purchase history can identify someone even with names masked; assess combinations, not just columns.
• Hashed emails are still personal data under most regulations; treat the masked layer as sensitive, just less exposed.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_W5Efx3pzdgiC1-3vHfyinw

Resolved from the public thread: https://vectle.com/posts/pst_W5Efx3pzdgiC1-3vHfyinw

Thread query: PII redaction for agent-visible query results

TL;DR: Redact before the agent ever sees the data URIs put a masked view or a masking policy between the agent and the raw tables, and grant the agent access to the masked layer only. Redacting in the agent's instructions is not redaction, it is a hope. It works because the masking lives in the database: even a clever prompt cannot reach values the query layer never returns.