Security and masking settings

Role: deployment operator. These steps use the operator console. An ordinary hosted account exposes only its own keys and limits; request policy, protection-mode and masking changes from the operator.

These settings affect real gateway requests. Global changes require an authorized administrator; edition and role can restrict individual actions. Display preferences and report filters do not change protection.

Where to enable or disable controls

Key modes

1. Open Access keys → Create API key, or the mode selector for an existing key.
2. Set label, tenant ID, expiry and mode. Store the once-shown raw key securely in the client.
3. Send a synthetic request using that key; verify action and actual perimeter in Request history → Router requests.

Rotation requires replacing the client key; revocation stops access. Operators manage env/bootstrap keys. Disabling a worker and revoking an inference key are separate actions.

Enlarge screenshot

1 2 3 4 5

1. Label
2. Tenant ID
3. Expiry
4. Strict policy
5. Create

Enable external_masked through the API

Use an administrative session authorized to write, not a normal inference API key. Send requests to your Router gateway, not the documentation site, with your organization’s approved authentication. Keep tokens out of URLs and JSON. Key management requires PostgreSQL.

1. GET /admin/keys: find the test key’s id and preserve its previous policy_mode. The secret/prefix is not its id.
2. PATCH /admin/keys/<id> with Content-Type: application/json:

{"policy_mode": "external_masked"}

3. Expect HTTP 200 and key metadata; re-read GET /admin/keys and confirm the mode. PATCH does not rotate the secret.
4. Send the next synthetic inference request with that key. Check X-IAM-Key-Policy-Mode: external_masked and actual replacement in the external flow. Raw private values must not reach the provider; impossible replacement should fail closed.
5. Restore the previous mode with the same PATCH and verify a new request. The change does not replay existing requests.

To create a key use POST /admin/keys with {"label":"Masked staging client","tenant_id":"docs-demo","policy_mode":"external_masked"}. HTTP 201 returns key once; store it securely. Optional expires_at is a future RFC3339 date; omission/null means no expiry. On 400 check JSON/mode/date; 401/403 needs administrative access; 404 needs the correct id; 503 means unavailable storage. An error is not proof of an applied change; read back before retrying.

Masking mode and floor

1. Open Request history → Router requests → IAM.Secure settings; the same panel is available in Routing Audit.
2. Choose masking mode and minimum protection.
3. Save, then Refresh to check the applied values. Save is enabled only after changes; refresh discards unsaved edits.
4. Check a synthetic request’s X-IAM-Masking-Mode, decision, perimeter and replacement evidence in history.

Enlarge screenshot

1 2 3

1. Mode
2. Protection floor
3. Save

Verdict classes does not turn masking off. It reduces rediscovery. In administrative writes specify both intended mode and floor: a weaker default can also lower the floor. Re-read both values. Router shares settings through its store across replicas; 503 does not prove a write applied.

Replacement substitutes detected values with KEY_N placeholders; semantic confidential content may not be safely replaceable. A mask_route rule escalates containment when replacement is impossible. Mapping TTL is separate from audit retention.

Complete routing policy reference

Policy → tenant ID → Load → Edit → Form / JSON. Preserve the existing document, preview changes, save and verify a scoped synthetic request. Preview replays an audit sample without applying policy or calling an LLM; an empty sample is not a safety proof.

A client model hint cannot lower containment. With an external-only provider registry the validator requires explicit blocks for private classes and classifier failure; policies needing absent on-prem fallback are rejected.

Enlarge screenshot

1 2 3

1. mask_route
2. Save
3. fail_closed

Enlarge screenshot

1 2 3

1. mask_route
2. Save
3. fail_closed

Synthetic-tenant JSON example

Use your test tenant in place of docs-demo. This example intentionally omits content_type to avoid mismatched classifier vocabularies.

{"name":"Private data stays inside","tenant_id":"docs-demo","perimeter_rules":[{"when":{"sensitivity":"RESTRICTED"},"action":"block"},{"when":{"sensitivity":"CONFIDENTIAL"},"action":"route","perimeter":"on_prem"},{"when":{"sensitivity":"INTERNAL"},"action":"mask_route","perimeter":"external"},{"when":{"sensitivity":"PUBLIC"},"action":"route","perimeter":"external"}],"cost_optimization":{"research_to_cheapest":false,"prefer":"balanced"},"on_classifier_unavailable":"block","on_injection_detected":"block","block_message":"Request blocked by organization policy","request_limits":{"max_output_tokens":4096,"max_prompt_chars":32000},"reasoning_effort":"none"}

Replace instead of blocking

1. Check strict key mode and a replaceable class.
2. Change only the targeted rule to mask_route and the required perimeter; keep stricter rules above it.
3. Test synthetic PII, secrets, semantic confidential text and injection. An overly broad rule must not silently allow the latter cases.
4. Find the actual outcome by request ID. If masking is impossible, expect greater containment or blocking rather than raw external delivery.

Cancel discards unsaved edits. After saving, restore the previous document or supported policy version. Rollback is revalidated against current providers and can return 422. Verify the restored document and a new request.

Passport data before model dispatch

This flow needs a protected strict or external_masked key, an available classifier, and enforce for class actions. The standard pii.passport registry uses mask in external and hybrid/on_prem scopes and allows originals in local. An exact tenant override can change that rule. external_unrestricted remains an explicit IAM.Secure opt-out.

1. Verify settings on staging first, using synthetic data only: Паспорт РФ серия 4521 номер 123456. This is a fictional example, not customer data.
2. Submit through the API used by your client. Separate series/number fields, line breaks, JSON metadata and string Unicode escapes are supported. Classification and replacement retain tool-name context and nested passport-field context in tool arguments.
3. Open Request history → Router requests, find the request ID and expand its row. Check pii.passport, mask_route, the actual perimeter and masking details. Highlights show detected original fragments and their transmitted placeholders. Original Input may remain in protected history; it is not the model-bound body.
4. For integration acceptance, also inspect the body at your test provider: a protected route must carry placeholders instead of passport values. A successful dry-run or HTTP 200 alone does not establish this.

Tool arguments retain JSON keys, containers and non-string scalar types. If a numeric passport field cannot accept a string placeholder without changing its JSON type, Router returns 503 masking_unavailable before provider dispatch. Send document identifiers as strings, preserving leading zeros, and repeat the synthetic check. If masking is unavailable, check IAM.Secure availability and masking mode/floor instead of bypassing the error with external_unrestricted.

The same rejection applies when detected ranges cannot safely map back to original text after removing invisible Unicode characters. One successful replacement does not authorize sending unresolved originals. Remove invisible separators inside identifiers in your client and repeat the check; protected original input remains available in history when retention permits it.

Detection covers explicitly identified passport fields. Ordinary order numbers and amounts without passport context do not become passports solely because of digit count. Qualify other document formats separately using your own test corpus.

Operator-only service parameters

These are source defaults, not verified values for your deployment. Hosted customers request changes through their administrator; self-hosted operators qualify configuration on staging.

All sections · Traffic analysis · FAQ

Class actions: off, shadow and enforce

Enlarge screenshot

1 2 3

1. Sample text
2. Test
3. Masked text

The deployment operator sets IAM_GW_DATA_CLASS_ACTIONS, or Helm gateway.dataClassActions. Classification, policy-based masking and registry actions are separate controls. off leaves registry actions as metadata. shadow calculates tightening without changing dispatch. enforce applies class actions in the effective perimeter. Check Data classes or GET /admin/data-classes → action_enforcement; the value depends on the deployment.

Use strict or external_masked for protected traffic. Under enforce, Tier0 retains detected code.secret even behind a confidentiality marker. The standard registry blocks it in external and hybrid/on_prem scopes and allows local processing; exact tenant overrides take precedence. external_masked applies actions in its final external scope and cannot convert block or local_only into external model delivery. For critical data whose verdict does not permit masking, a requested mask is not treated as successful: external dispatch is blocked.

Before enabling on a working deployment, qualify staging with a synthetic credential without real permissions, ordinary public text, supported PII masking, marker-only text, tenant overrides and an unavailable inspector. Verify action block, Request ID and absence of provider calls; RESTRICTED or a green badge alone is insufficient. A policy block may return HTTP 200 with a synthetic Router response, which is not model generation. Clients cannot opt out using a JSON field: the mode comes from authenticated API-key metadata.

external_unrestricted deliberately skips Secure screening and these class actions while retaining authentication and quotas. Do not use it to verify protection guarantees. Reverting to off disables enforcement for subsequent requests; this changes protection, not just the display. Previous requests are not replayed.