---
title: "Redact PII on the device"
lesson_id: "04"
---

# Redact PII on the device

- **Lesson ID:** 04
- **Goal:** Redact emails, phones, links, and card-shaped numbers before the model or PCC.
- **Human lesson:** [04-pii-redaction.html](04-pii-redaction.html)

## Prerequisites

Lesson 03.

## Inputs, outputs, and artifacts

- **Inputs:** Strings that may contain PII.
- **Outputs:** Tokenized text and a restore map that never enters the transcript.
- **Artifacts:** PIIRedactor sketch using NSDataDetector.

## Agent build steps

1. Use on-device detectors and local regex.
2. Keep restore maps out of the transcript.
3. Redact again before PrivateCloudComputeLanguageModel.
4. Link [Run tools in a safe box](../on-device-sandboxed-tools/), [Talk to tools with MCP](../on-device-mcp-server-client/), and [Make several agents agree first](../on-device-multi-agent-consensus/).

## Constraints

iOS 27 or later, or macOS 27 or later, and Xcode 27. Plain spoken English. No metaphor, quizzes, Mermaid, or em dashes. Apple's Guardrails.default is a safety filter, not PII redaction or injection detection. Do not invent a built-in injection API.

## Key concepts

- Detect links, phones, emails, and card shapes, then replace them with tokens.
- Redact before `respond`, before tools, and before Private Cloud Compute.
- The token-to-original map stays outside the session transcript.
- Restore values in the UI only, not inside `respond`.

## Takeaways

- The transcript should hold tokens, not account numbers.
- Never send raw PII to Private Cloud Compute.
- A tool must not read an unredacted file after you stripped the prompt.

## Acceptance checks

- Redaction happens on device.
- PCC is called out as needing a clean packet.
- Sibling links, progressive .flow diagrams, and the Agent brief link are present.
- [ ] Proceed to [lesson brief](05-keep-checks-on-device.llms.md).