How Anthropic Keeps PII Out of Model Context
TRIGGER
Agents needed to orchestrate workflows involving sensitive data (emails, phone numbers, names) flowing between systems—like importing customer contacts from a spreadsheet to a CRM—but having PII pass through model context created compliance and data handling risks.
APPROACH
Intercept data at the MCP client layer and replace PII with deterministic tokens before it reaches the model. Input: raw data with PII (`{email: 'john@example.com', phone: '555-1234'}`). Output: tokenized data in model context (`{email: '[EMAIL_1]', phone: '[PHONE_1]'}`). When the agent writes code using these tokens in subsequent tool calls, the MCP client untokenizes via lookup before execution. Real data flows between external systems but never enters model context.
PATTERN
“Every real email, phone, or name in model context is a compliance incident waiting to happen. Replace PII with deterministic tokens at the boundary and detokenize at execution. The model orchestrates on handles; your logs stay clean.”
✓ WORKS WHEN
- Workflow involves PII that must flow between systems but shouldn't be logged or processed by model
- PII types are identifiable with pattern matching (emails, phones, SSNs, names from structured fields)
- Agent code references data by position/identifier rather than by semantic content
- MCP client architecture allows interception layer between tool results and model context
- Deterministic tokenization is acceptable (same value = same token across calls)
✗ FAILS WHEN
- Model needs to reason about PII content (e.g., 'which email domain has most customers')
- PII is embedded in unstructured text where pattern matching has high false positive/negative rates
- Workflow requires model to generate or modify PII values, not just pass them through
- Token-to-value mapping storage introduces unacceptable security risk
- Real-time detokenization latency exceeds workflow time budget