Balanced, strict, and maximum
| POLICY | DEFAULT MODE | CHARACTER |
|---|---|---|
| balanced-v1 | balanced | Pseudonymize direct identifiers, generalize precision, remove unnecessary labeled facts, block credentials |
| strict-v1 | strict | Remove contact, IP, bank, and wallet identifiers; preserve relational usefulness through controlled pseudonyms |
| maximum-v1 | maximum | Aggressive line minimization, organisation conceptualization, secret blocking, and local routing for health data |
Seven decisions—no ambiguous redact flag
KEEP
Preserve the value only when policy and purpose explicitly allow its precision.
REMOVE
Delete the value and do not create a reversible mapping.
PSEUDONYMIZE
Replace the value with a session-bound placeholder stored only in the Vault.
GENERALIZE
Reduce precision while keeping a useful category, band, or range.
CONCEPTUALIZE
Replace the literal with a role or semantic description.
BLOCK
Stop the operation because credential-like material must not proceed.
LOCAL_ONLY
Keep processing inside the trusted environment and prohibit external routing.
Create a versioned rule set
- policy_id must match the lowercase identifier pattern and be unique.
- A custom policy contains one to 100 rules.
- The server canonicalizes the complete policy and records its SHA-256 hash on each receipt.
- Unknown entity classes fall back to pseudonymize in the current alpha.
{
"policy_id": "legal-review-v1",
"name": "Legal review",
"description": "Retain obligations; minimize direct identity.",
"rules": {
"PERSON": { "action": "pseudonymize", "description": "Keep party relationships" },
"EMAIL": { "action": "remove", "description": "Not needed for review" },
"FINANCIAL_VALUE": { "action": "generalize", "description": "Preserve magnitude" },
"PRIVATE_KEY": { "action": "block", "description": "Never externalize" }
}
}Test by entity class and failure mode
- 01
FIXTURE
Build an authorized synthetic corpus for every entity class relevant to the workflow.
- 02
EXPECTED ACTION
Declare the exact transformation and route for every fixture before running it.
- 03
FALSE NEGATIVES
Treat missed high-impact entities and credentials as release blockers.
- 04
UTILITY
Verify that protected output still supports the declared task instead of measuring privacy alone.
- 05
HASH
Record the policy hash with deployment and receipt evidence so later behavior can be attributed.