Personal data in completion

This page explains what the Personal data in completion rule checks, what it needs to run, and how to set it up for your product.

Definition

Personal data in completion (key pii_in_output) flags a model call whose completion contains personal data about a real person. It uses a classifier: a model reads the completion and picks one label for it.

The classifier gives each completion one of these labels:

• none: no personal data, or only clearly made-up placeholder data
• email
• phone
• postal_address
• government_id
• payment_card

The rule fails a call when the label isn't none and the label is one of the classes you chose to report. Any other label gives a pass. Calls with an empty completion aren't checked, and no result is recorded for them.

When a call fails, the result's reasoning starts with the label, followed by the classifier's explanation. For example: "classified as email — the reply contains a customer's email address."

Why it matters

A model can leak personal data in a reply even when your prompts and code look fine. A regular expression only catches data written in the expected format. A classifier also catches data written out in other ways, such as an email address written as "j dot doe at example dot com", or a card number written in words.

What it requires

• Permission to change rules. To create this rule, you need permission to modify the project. For details, see Project permissions.
• A model for classifier rules. Classifier rules run only when your AIO deployment has a model API key set up for rule evaluation. Without one, this rule doesn't run, and its results show as "pending" in the UI.
• Completions in your traces. The rule reads the completion text of each LLM call, so your application must send it. To send traces, see Instrument your code.

Each call the rule classifies costs one model call.

Parameters

Only the classes you select can raise a finding. The classifier still labels every completion, but a label you didn't select counts as a pass.

If you clear every class and then select Save & enable, you get the message "Which classes to report is required."

Configuration examples

Create the rule

1. On the Rules page, select + New rule.
2. On the New rule page, enter Personal data in Search templates, and then select Configure › on the Personal data in completion card.

3. On the Configure rule page, choose a Project, and change Name or Severity if you need to.
4. For Which classes to report, select the classes you want findings for.

5. Select Save & enable.

The rule is turned on as soon as you save it. For the full procedure, including validation messages, see Create a rule.

Report every class

Keep the default, with all five classes selected. This setup suits products that should never repeat personal data, such as a public chatbot or a content generator.

Allow the user's own email address

Clear email, and keep phone, postal_address, government_id, and payment_card selected. Use this setup for a support assistant that reads back a customer's own email address. That's expected in your product, so it shouldn't raise a finding.

Watch only high-risk identifiers

Select only government_id and payment_card. Use this setup when contact details are a normal part of your replies, but identity numbers and card numbers must never appear.

Related

• Banned term in output finds terms that match a pattern you write, with no model call.
• Redact by pattern scrubs matching text inside your application before data is sent to AIO.
• Explore traces shows where findings appear on traces and calls.

Next steps

• Create a rule
• Rules overview
• Explore traces
• Project permissions