Skip to main content

Sensitive Field Handling

Evidence status: The evaluator finding and regenerated audit_mask_fields metadata were verified. Runtime masking in safe sinks, responses, raw/debug paths, exports, and failures has not yet been executed.

Problem​

Record useful audit evidence without exposing passwords, tokens, identifiers, contact details, health data, or payment-related values to logs and downstream audit consumers.

Model​

Declare audit masking in the model:

<customer
  _name="Customer"
  name="string()"
  email="string()"
  phone="string()"
  passport_number="string()"
  _audit_mask_fields="email,phone,passport_number" />

Evaluate the model and treat high-sensitivity findings as blocking until they are reviewed.

Runtime Boundary​

Masking is only one layer:

  1. Authorization controls whether the field may be read.
  2. Generated selection controls whether the field is loaded or returned.
  3. Audit metadata records why an operation happened.
  4. Safe audit events mask configured values.
  5. Log level and sinks control where evidence is sent.
  6. Encryption, secrets management, retention, deletion, and residency remain application/platform responsibilities.

Do not use masking as proof that access is authorized.

Verification​

  • Evaluate a model containing representative sensitive names. The verified evaluator identifies email as a contact identifier and suggests adding it to _audit_mask_fields; evaluate again after changing the model.
  • Inspect generated entity metadata and confirm the expected field appears in audit_mask_fields; do not patch the generated annotation.
  • Perform an audited mutation of each sensitive field.
  • Confirm the safe audit sink does not receive raw values.
  • Confirm raw/debug sinks are disabled or access-controlled in production.
  • Confirm application responses omit fields not required by the use case.
  • Test truncation for long free-text fields where configured.
  • Verify exports, support tools, and error paths as well as normal requests.

Failure Modes​

SymptomFix
Field is masked in audit but returned to unauthorized clientAdd field-level authorization/selection policy; masking is not access control.
Raw value appears in debug outputReduce log detail, configure safe sinks, and review payload logging.
New sensitive field is unmaskedUpdate model metadata and add evaluation/verification tests.
Audit is unreadableKeep field/change metadata and business purpose while masking values.

References​