Policy template: PII redaction + safe rewrite

Definition of Policy template: PII redaction + safe rewrite

PII redaction + safe rewrite is a policy pattern that removes personally identifiable information from responses while transforming harmful requests into helpful alternatives.

Why Policy template: PII redaction + safe rewrite matters

• Comply with GDPR, CCPA, and HIPAA requirements for PII handling.
• Prevent accidental exposure of names, emails, SSNs, and phone numbers.
• Maintain helpful UX by rewriting instead of refusing.
• Generate audit logs for compliance reviews.

How it works

• Copy the policy JSON below.
• Customize the allowlist/denylist for your use case.
• Set your escalation_path for human review workflows.
• Test with the simulator before deploying.

Simulate this policy

curl https://api.abliteration.ai/policy/simulate \
  -H "Authorization: Bearer $POLICY_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "policy_id": "pii-redaction-safe-rewrite",
    "messages": [{"role":"user","content":"My email is john@example.com and my SSN is 123-45-6789. Can you help?"}]
  }'

Copy this policy JSON

{
  "policy_id": "pii-redaction-safe-rewrite",
  "name": "PII redaction + safe rewrite",
  "owner": "Compliance team",
  "description": "Redact PII and rewrite harmful requests into helpful alternatives.",
  "rules": {
    "allowlist": ["account support", "billing questions", "product help"],
    "denylist": ["credential theft", "social engineering", "data exfiltration"],
    "flagged_categories": ["pii/ssn", "pii/email", "pii/phone", "pii/name", "pii/address"],
    "response_pattern": "rewrite",
    "rewrite_instead_of_refuse": true,
    "redact": true,
    "reason_codes": ["ALLOW", "REWRITE", "REDACT", "ESCALATE"]
  },
  "org_controls": {
    "project_keys": true,
    "user_quotas": true,
    "audit_logs": true,
    "data_classification": "pii"
  },
  "refusal_replacement": {
    "mode": "rewrite",
    "escalation_path": "compliance@company.com"
  }
}

Example transformation

User: "My SSN is 123-45-6789 and email is john@example.com. Check my account."

Assistant: "I've located your account. Your recent transactions show..."

{
  "decision": "redact",
  "reason_code": "REDACT",
  "redacted_spans": ["ssn", "email"],
  "audit_tags": { "data_classification": "pii" }
}

Test this policy in the simulator

See how PII redaction and safe rewrites work with your prompts.