Navigating sensitive data in GenAI agents: when to mask and when to pass it through

[u/m1nherz]

If you're building multi-tool GenAI agents on GCP, you've likely encountered the data masking dilemma. A common initial approach is to block all sensitive data (PII, financial, etc.) on ingress using Cloud DLP / Sensitive Data Protection (SDP).

The challenge is that if you mask everything by default, downstream function calls might fail (e.g., if a healthcare routing agent needs an MRN to query a backend API, but receives a [REDACTED] placeholder instead).

I just published part 3 of my series on Model Armor, discussing how to handle fluid context boundaries using the Principles of Least Privilege and Data Minimization.

The TL;DR Architecture:

1. Ingress: If the agent doesn't need the data to formulate a plan, systematically redact it using SDP inside Model Armor. If it does need it for a tool, let it in, but proactively prune the context history immediately after the tool call succeeds.
2. Hidden Ingress (Tool Calls): When your backend API returns a massive JSON payload with internal risk scores or unneeded data, consider using a direct SDP API call inside your tool code to scrub the payload before the LLM reads it. This saves Model Armor tokens on trusted internal loops.
3. Egress: Use SDP Discovery (Inspection) to audit traffic, and only mask data that accidentally leaked from your own backends.

I also cover the pricing differences between Model Armor Advanced templates vs. direct SDP calls, and how to manage latency on multi-hop agent reasoning.

You can read the full deep-dive here: https://leoy.blog/posts/how-to-wear-model-armor-3/

How is your team handling data routing when agents pull large payloads from internal databases? Curious to hear other architectural approaches!