How do I configure Galileo Protect to redact PII in real time and log an auditable reason code?

LLM systems don’t get a second chance after a PII leak. Once an agent exposes a phone number, SSN, or email to the wrong user, the damage is done—and audit teams will want to know exactly what failed. Galileo Protect is built to prevent that scenario by redacting PII in real time and attaching a deterministic, auditable reason code to every intervention.

Quick Answer: Use Galileo Protect’s guardrail policies to score every input/output for PII, apply a “redact” action with a consistent replacement pattern (e.g., [REDACTED_PII:EMAIL]), and configure logging so each interception writes a structured audit record with a reason code like PII_EMAIL_DETECTED or PII_PHONE_BLOCKED.

---

The Quick Overview

• What It Is: A real-time guardrail configuration in Galileo Protect that detects PII in prompts and responses, automatically redacts it, and logs a machine-readable reason code for audits and compliance reviews.
• Who It Is For: Teams running RAG systems, support agents, internal copilots, or autonomous agents in regulated or high-risk environments (finance, healthcare, telco, SaaS B2B) who must enforce strict PII handling and prove it.
• Core Problem Solved: You need to stop PII leaks before they reach end users or tools, without blowing your latency budget—and you need the audit trail to prove what happened and why.

---

How It Works

At a high level, you wire Galileo Protect into your LLM stack as a runtime firewall: every prompt and response flows through Protect, gets scored by Luna-2–powered PII evaluators, and—if a threshold is crossed—gets redacted before it leaves your system. Every interception is logged with structured metadata, including a reason code, so compliance teams can reconstruct exactly what happened.

Here’s the lifecycle:

1. Instrument traffic through Protect:
   Route all relevant inputs/outputs, plus context like user/session IDs and tool calls, through Protect. This gives you a single place to enforce PII rules.

2. Configure PII detection & redaction rules:
   Use Protect’s policy UI or API to select PII evaluators, set thresholds, define the redaction format, and attach a reason code schema.

3. Audit, iterate, and version policies:
   Review logs for intercepted events, tune thresholds to reduce false positives/negatives, and version policies so you can roll back safely without code redeploys.

---

Step-by-Step: Configuring Galileo Protect for Real-Time PII Redaction

1. Wire Protect into your LLM request/response path

You want Protect sitting in the hot path so it can intercept PII before a response hits a user or downstream tool.

Typical integration patterns:

• Reverse proxy / middleware:
  • Ingress → Protect → LLM / agent → Protect → Client
  • Every request and response passes through Protect for evaluation.
• SDK / API wrapper:
  Wrap your LLM client (OpenAI, Anthropic, Vertex, NeMo, etc.) with a Protect client that:
  1. Sends the user prompt to Protect for pre-model checks (prompt injection, PII in input).
  2. Sends the model’s draft response back to Protect for post-model checks (PII in output).
• Agent framework integration:
  For CrewAI or similar frameworks, attach Protect at the session or tool-execution layer so you see sessions → traces → spans, including tool calls that may expose PII.

Key configuration details:

• Ensure each call includes:
  • session_id / trace_id
  • User or tenant ID
  • Channel (e.g., web, support_portal, internal_agent)
• Confirm your latency budget: Protect is designed for sub-200ms guardrailing; most teams place it inline on 100% of traffic.

2. Enable PII evaluators in Protect

PII detection in Protect is driven by evaluators served on Luna-2. These are lightweight models tuned to detect sensitive entities at low cost and low latency.

In the Protect UI (or via API):

1. Create or edit a guardrail policy

   • Scope it to the relevant surface: “customer_support_agent”, “internal_copilot”, “tool:send_email”.

2. Attach PII evaluators

   • Enable PII-related metrics, for example:
     • PII_EMAIL
     • PII_PHONE
     • PII_ADDRESS
     • PII_FINANCIAL (account numbers, card fragments)
     • PII_GENERIC (names, IDs depending on your domain)
   • For each evaluator, set:
     • Threshold: Score above which content is considered unsafe.
     • Coverage: Inputs, outputs, or both.

3. Decide on input vs output behavior

   • Inputs: Block or redact PII before it hits the model (useful if your policy is “agents must never see raw PII”).
   • Outputs: Redact PII before the user or downstream system sees it.

Best practice:
Start by redacting on outputs only so you don’t interfere with legit support flows, then tighten to include inputs if your data handling policies require it.

3. Configure the redaction pattern

Once PII is detected, Protect should override the unsafe span with a deterministic redaction token.

In your policy:

• Set Action for PII evaluators to REDACT.
• Define Redaction Format, for example:
  • Simple generic:
    • [REDACTED]
  • Type-specific (strongly recommended for debugging and analytics):
    • [REDACTED_PII:EMAIL]
    • [REDACTED_PII:PHONE]
    • [REDACTED_PII:ADDRESS]

Why type-specific tags matter:

• Debugging: You can see what type of PII was blocked without exposing the actual value.
• Analytics: Query logs for “which PII type is most common?”.
• Compliance: Proves you’re not just blocking arbitrarily; you’re enforcing a specific PII policy.

Example transformation:

• Raw model output:

  “You can reach Jane at jane.doe@example.com or +1-555-123-4567.”

• After Protect redaction:

  “You can reach Jane at [REDACTED_PII:EMAIL] or [REDACTED_PII:PHONE].”

4. Attach a structured, auditable reason code

Redaction alone isn’t enough—you need a reliable reason code for every intervention.

In Protect:

1. Define a reason code schema

   • Decide on consistent codes such as:
     • PII_EMAIL_DETECTED
     • PII_PHONE_DETECTED
     • PII_ADDRESS_DETECTED
     • PII_MULTIPLE_TYPES
   • Or map to your internal policy IDs:
     • POLICY_PII_001_EMAIL
     • POLICY_PII_002_PHONE

2. Map evaluator → reason code

   • In the policy configuration, for each PII evaluator:
     • Assign reason_code: "PII_EMAIL_DETECTED" (for PII_EMAIL)
     • Assign reason_code: "PII_PHONE_DETECTED" (for PII_PHONE)
   • For composite metrics or “catch-all” PII:
     • Use reason_code: "PII_GENERIC" or PII_MULTIPLE_TYPES.

3. Enable structured audit logging

   • Ensure Protect is configured to emit logs to:
     • Your SIEM (Splunk, Datadog, Elastic)
     • Data warehouse (Snowflake, BigQuery, Redshift)
     • Compliance log store (S3 with write-only permissions)
   • Include at minimum:
     • Timestamp
     • Session/trace/span IDs
     • Direction (input/output)
     • Evaluator name
     • Score
     • Action (REDACT)
     • reason_code
     • Redaction type (if applicable)

Example audit record (JSON-like):

{
  "timestamp": "2026-04-12T19:54:23.451Z",
  "policy_id": "support_agent_pii_v3",
  "session_id": "sess_87432",
  "trace_id": "trace_1298",
  "span_id": "span_003",
  "direction": "output",
  "evaluator": "PII_EMAIL",
  "score": 0.97,
  "action": "REDACT",
  "reason_code": "PII_EMAIL_DETECTED",
  "redaction_type": "REDACTED_PII:EMAIL"
}

This is the auditable evidence your risk and compliance teams want: machine-readable, consistent, and tied to the exact guardrail that fired.

5. Test the configuration before turning on full enforcement

Before you go to 100% traffic, use Protect’s evaluation tools to validate your setup.

1. Run in “monitor-only” mode

   • Set the policy to log and tag PII but not redact yet.
   • Send test traffic from your staging stack and “synthetic PII” examples.
   • Compare evaluator scores to human judgement to calibrate thresholds.

2. Use golden test sets

   • In Galileo Evaluate, build a test set with:
     • Known PII examples (emails, phones, addresses, IDs).
     • Near-miss examples (fake numbers, partial data) to check for over-blocking.
   • Run your Protect policy against this test set and inspect:
     • Precision (false positives)
     • Recall (false negatives)
     • Reason code correctness and consistency.

3. Promote to enforcement

   • Once thresholds look good, switch the policy to active redaction.
   • Start with a subset of services or traffic (e.g., internal agents) if you want a safer rollout.

6. Iterate, version, and roll back safely

PII patterns and regulatory expectations evolve. Protect is designed so you can evolve with them—without redeploying app code.

In Protect:

• Version policies
  • Treat each significant change (threshold tweak, new evaluator, new reason code) as a new policy version.
  • Example: support_agent_pii_v1, support_agent_pii_v2.
• Maintain history and rollbacks
  • If a new version is too aggressive (e.g., redacting order IDs that aren’t PII), roll back to the previous version with a click or API call.
• Monitor trends
  • Use Signals + Protect logs to:
    • Track PII interception rate over time.
    • Detect spikes that may indicate upstream issues (e.g., new integration leaking raw PII).
    • Identify domains or tools that require more granular policies.

---

Features & Benefits Breakdown

Core Feature	What It Does	Primary Benefit
Luna-2 PII Evaluators	Scores every input/output for multiple PII types in <200ms	Real-time redaction without blowing your latency budget
Redact Action Engine	Overrides risky spans with deterministic tokens ([REDACTED_PII:TYPE])	Prevents PII leaks while preserving conversational and agent context
Structured Reason Code Logging	Logs each interception with policy, evaluator, and reason code metadata	Gives compliance a clean, auditable trail for every protected interaction

---

Ideal Use Cases

• Best for customer-facing support agents:
  Because it lets agents access enough context to resolve tickets while automatically redacting PII from model responses and logging reasons for every interception.

• Best for internal copilots with sensitive backend access:
  Because it catches accidental PII exposure from logs, tickets, or database fields and records a clear reason code, keeping internal tools compliant without full data lockdown.

---

Limitations & Considerations

• Domain-specific PII patterns:
  Evaluators handle common PII (emails, phones, addresses, IDs), but niche identifiers (e.g., proprietary account IDs) may require custom evaluators or few-shot tuning. Workaround: use Galileo’s Evaluation Engine + CLHF to create domain-specific PII evaluators and then deploy them into Protect.

• Context vs. compliance trade-offs:
  Fully redacting all PII may reduce agent effectiveness for complex workflows (e.g., account verification). Workaround: selectively redact in outputs while allowing limited PII visibility in inputs, or gate full PII visibility behind role-based access and stricter logging.

---

Pricing & Plans

Galileo is licensed at the platform level, with Protect included alongside Evaluate and Signals so you can run the full eval-to-guardrail lifecycle.

Common patterns:

• Team / Starter Tiers: Best for product and platform teams piloting LLM apps that need PII redaction + basic guardrails for a few key surfaces or agents.
• Enterprise Tiers: Best for organizations with multiple agent teams, strict compliance requirements, and the need for VPC/on-prem deployment, SOC 2 Type II posture, HIPAA-aligned infrastructure, and 100% traffic coverage at predictable cost.

For exact pricing, throughput tiers (e.g., 5,000+ traces/month, 10,000+ requests/min), and deployment options (SaaS, VPC, on-prem), contact Galileo directly.

---

Frequently Asked Questions

Can I customize what counts as PII and the reason codes used?

Short Answer: Yes. You can customize evaluators, thresholds, and the exact reason codes that get logged.

Details:
Out of the box, Protect ships with Luna-2 PII evaluators for standard entities. If your domain has special identifiers (e.g., “membership numbers starting with MX-”), you can:

• Create a custom evaluator in Galileo’s Evaluation Engine (LLM-as-judge or rules-based).
• Tune it with CLHF using real examples from your traffic.
• Deploy it into Protect as part of your PII policy.
• Map that evaluator to custom reason codes like PII_MEMBERSHIP_ID_DETECTED.

All of this can be done without changing your app code—only the Protect policy needs updating.

Will real-time PII redaction slow down my agents?

Short Answer: Protect is designed to run PII guardrails inline within sub-200ms, even at 100% traffic coverage.

Details:
Because Galileo distills evaluators into compact Luna / Luna-2 models and serves them on a purpose-built inference stack, you avoid the latency and cost penalties of heavyweight LLM judges. Typical setups see:

• Single-digit to low triple-digit milliseconds added at the guardrail layer.
• 97%+ lower evaluation cost compared to calling a large general-purpose LLM as judge on every request.
• Consistent performance as traffic scales, so you can keep PII guardrails always on instead of sampling.

If you have extremely tight latency SLAs, you can configure different policies per surface (e.g., stricter PII detection on async agents, lighter on ultra-low latency flows).

---

Summary

Configuring Galileo Protect to redact PII in real time and log an auditable reason code comes down to three moves:

1. Put Protect in the hot path so every input/output passes through Luna-2 PII evaluators.
2. Set redaction actions and patterns that surgically replace PII with deterministic tokens while preserving the rest of the agent response.
3. Attach structured reason codes and logs so every redaction is recorded with machine-readable metadata your compliance and security teams can trust.

You’re not just monitoring for PII after the fact—you’re intercepting it before it leaks, with a clear, verifiable record of what was caught and why.

---

Next Step

Get Started