PII detection and masking decisions, run by agents
Sensitive data spreads faster than anyone can inventory it, and masking decisions wait on a spreadsheet. Data Workers agents find and tag personal data in the tables you point them at, then propose a masking decision for each sensitive column for a person to approve.
Before and after
| Today | With Data Workers |
|---|---|
| A sensitive-data inventory in a spreadsheet, stale by the next release | Columns checked for personal data as tables appear |
| Detection by column name alone, so a "notes" field slips through | Detection by name and by content, with sample values kept inside your network |
| Tags that live in one tool and mean nothing to the rest | Tags that lineage, access and quality agents act on |
| A masking decision made ad hoc, table by table | A proposed decision for every sensitive column, ready for approval |
| Personal data pasted into docs, notes and tickets | Agents scrub personal data and secrets from anything they write |
Every new source, model and log stream is a new place for personal data to land, and a privacy review that happens once a quarter finds it late. Agents can keep the inventory current and bring each masking decision to its owner with the evidence attached. For the mechanics of scanning a warehouse, see automated PII detection in data warehouses; this page is about who does the work and who decides.
How it works
1. Find the sensitive data
The Data Access & Governance agent uses scan_pii on the tables you point it at. It looks at column names and at the values inside, so a free-text field named "comments" is checked as well as one named "email". Sample values stay inside your network.
2. Tag it so everyone treats it differently
The Data Context & Catalog agent labels each finding with auto_tag_dataset, and get_lineage shows where the column flows next. Because the tag lives in the catalog, the lineage, access and quality agents treat those columns differently from then on. Agents also scrub personal data and secrets out of anything they write, such as documentation, notes and tickets.
3. Propose a masking decision for a person to approve
For each sensitive column the Data Access & Governance agent drafts a masking decision and sends it to a named approver through request_governance_review, with the evidence and the downstream consumers attached. The approver accepts, changes or rejects it. The agents propose; they do not apply masking on their own.
The impact metrics we move
- •Sensitive-column inventory for one domain: from about a week to 1 day
- •New table checked for personal data: from about 2 days to 30 min
- •Masking decision drafted per column: from about a day to 15 min
Where teams start
- •Your customer and account tables. Names, emails, addresses and identifiers in the warehouse tables the most people can query.
- •A new data source before it goes live. Check every column on arrival, before analysts find it.
- •Free-text fields. Support notes, comments and descriptions where personal data hides.
- •Regulated domains. Financial services and healthcare identifiers, with ready-made classifications for both.
- •Data headed to AI tools. Know which columns carry personal data before a model or an agent can read them.
What powers it
The Data-Agents Swarm does the work: the Data Access & Governance agent finds sensitive data and drafts the decisions, the Data Context & Catalog agent tags it and traces where it flows. The Autonomous Data-Conductor coordinates them, Autopilot Routines run the scan on every new table, and Spellbook Data Catalog keeps the tags next to the data they describe. If you already run a sensitive-data tool, the data masking comparison shows where agents add to it. Where this shows up in practice:
The climb: from assisted to autonomous to agentic
Every transformation runs on the ladder from our thesis. Agents start by watching and suggesting (L0 to L2 run today), and a domain can move further up on evidence from its own receipts. Masking stays a human decision: your privacy owner approves every one. For how Data Workers handles personal data in its own work, read how Data Workers handles PII.
The pilot
- •Scope. One domain: the customer-facing tables and the pipelines that feed them.
- •First week. Agents start by watching and suggesting: they scan the tables, list the sensitive columns they find and show the masking decisions they would propose, with receipts.
- •By week two. Findings are tagged in the catalog, each sensitive column has a proposed decision with a named approver, and anything sensitive stays with a person.
- •At day 30. We review the impact metrics against your baseline:
- •Sensitive-column inventory for one domain: from about a week to 1 day
- •New table checked for personal data: from about 2 days to 30 min
- •Masking decision drafted per column: from about a day to 15 min
- •Cost. Start with a pilot ($7,500 one-time, credited in full against the first year). Scale is from $1,000 a month and Enterprise from $3,000 a month, billed annually, with unlimited seats, no usage meter and no markup on model spend. See pricing.
FAQ
Do the agents mask the data? No. They find and tag sensitive data and propose a masking decision for each column. A person approves it, and your warehouse's own masking and access controls enforce it. The step-by-step PII playbook shows where each control sits.
Does our data leave our network? Detection works on the tables you point it at, and sample values are not sent outside your network.
What if the agent misses a column or flags the wrong one? The approver sees the evidence for every finding and decides. A column that was missed is added to the inventory and the next scan picks it up.
Which stacks does this cover? Scope is agreed in the pilot around the warehouses and catalogs you run, and we start with the tables you point us at rather than a full estate scan.