PII redaction
The default guardrail chain rewrites known sensitive patterns to <redacted:type> before protected content reaches durable Task history, checkpoints, client presentation, or evolution telemetry.
Redaction is not outbound DLP
Pattern matching does not guarantee secret or personal-data discovery. It does not sanitize the system prompt, conversation history, Agent tool inputs, or other Task context sent to the selected model provider. Memory persistence checks are also not a model-egress scrubber. Review Data flow and privacy boundaries before using sensitive data.
What's redacted by default
15 patterns ship out of the box:
| Marker | Matches |
|---|---|
<redacted:email> | (?i)\b[\w.+-]+@[\w-]+\.[\w.-]+\b |
<redacted:phone> | US phone numbers (+1-xxx-xxx-xxxx etc.) |
<redacted:cn-phone> | Chinese mobile numbers (1[3-9]\d{9}) |
<redacted:cc> | Credit card (Luhn-ish, 13-19 digits) |
<redacted:ssn> | US SSN |
<redacted:cn-id> | Chinese national ID |
<redacted:ipv4> | IPv4 addresses |
<redacted:iban> | International bank account |
<redacted:api-key> | OpenAI-style sk-/ak-/pk-/rk- keys |
<redacted:jwt> | JWT bearer tokens |
<redacted:aws-key> | AWS access key (AKIA[0-9A-Z]{16}) |
<redacted:aws-secret> | AWS secret access key |
<redacted:private-key> | PEM -----BEGIN PRIVATE KEY----- blocks |
<redacted:github-token> | gh[pousr]_* tokens |
<redacted:slack-token> | xox[baprs]-* tokens |
Cloud credential patterns cover AWS, GitHub, Slack, and PEM private-key material.
What's protected
With redaction active, Kairo checks complete model text, thinking, and tool-result blocks before they reach durable Task history, checkpoints, interactive clients, or evolution telemetry. Raw incremental frames are withheld because a sensitive value may span several chunks; clients receive the complete redacted block after it has been checked.
Safety policy initialization is fail-closed. If the configured guardrail chain cannot be built, Task creation fails with an actionable Host error instead of silently running unprotected.
The policy does not redact the Agent's tool inputs, the system prompt, or conversation history sent to the model. Do not put credentials or personal data into prompts or ask an Agent to write them.
What Desktop users should do
- Keep real credentials and personal data out of prompts, attachments, repository fixtures, and screenshots even when redaction is enabled.
- Treat a visible
<redacted:type>marker as evidence that one known pattern was replaced, not as proof that the whole Task is free of sensitive data. - If synthetic sensitive text is displayed unchanged, stop the Task and contact your approved Kairo Code support channel before opening a production repository.
Administrator-only guardrail overrides and diagnostic procedures are intentionally not part of the public Desktop manual.
Other policies in the chain
PII is one of four default policies. Disabling PII does not disable the other safety policies:
- Dangerous-command policy — blocks destructive shell commands such as filesystem formatting or recursive deletion of a system root.
- Path policy — blocks traversal and file operations outside the authorized workspace.
- Tool-loop policy — warns when the model calls the same tool + args ≥3 times, denies at ≥5
If a policy produces a false positive, note the visible error and the action that triggered it, remove private content from any screenshot, and send that reviewed evidence through your organization's Kairo Code support channel.