{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"redocly_category":"Products","product_name":"AI Agent Foundry","type":"markdown"},"seo":{"title":"Configure column-level access control to keep PII out of LLMs","description":"Use Treasure AI Column-Level Access Control to mask PII in Audience Studio and Data Workbench while preventing PII from reaching external LLM providers when AI Agent Foundry agents run inference.","siteUrl":"https://docs.treasuredata.com","lang":"en-US","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"configure-column-level-access-control-to-keep-pii-out-of-llms","__idx":0},"children":["Configure column-level access control to keep PII out of LLMs"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use this guide to allow business users to view PII in Audience Studio and Data Workbench while preventing PII from being sent to external LLM providers (Bedrock, OpenAI, etc.) when AI Agent Foundry agents run inference."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The configuration uses Treasure AI's Column-Level Access Control to hash PII at the data layer. The masking carries through Data Workbench, Audience Studio, and AI Agent Foundry agents from a single configuration, persists across Parent Segment refreshes, and requires no manual re-tagging."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"prerequisites","__idx":1},"children":["Prerequisites"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A Treasure AI account with Column-Level Access Control enabled (Customer Success enables this; confirm by checking that an auto-generated ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Columns full"]}," policy exists in ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Control Panel"]}," → ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Policies"]},"). For background, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/control-panel/security/tag-management/about-column-level-access-control"},"children":["About Column Level Access Control"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Admin access to the account."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A Parent Segment whose master output table contains the PII columns you want to protect."]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Entitlement and scale guidance"},"children":[{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Entitlement"]},": Column-Level Access Control is part of the Advanced Security feature set. ICDP plans typically include it; some legacy plans may not. If you don't see the policy options described below, contact your account team to confirm entitlement."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Tag only true PII fields, not entire schemas."]}," This feature is designed for selective protection of sensitive columns (e.g., email, phone, address). Tagging columns wholesale across many tables can hit architectural limits and degrade query performance. As a guardrail, an account can hold at most 25,000 column annotations in total; queries from accounts that exceed this limit may slow down or fail. Keep the tagged column count well under that ceiling."]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-1-create-a-policy-tag","__idx":2},"children":["Step 1. Create a policy tag"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Navigate to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Control Panel"]}," → ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Resources"]}," → ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Tags"]}," → ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Add Tag"]},"."]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Namespace"]},": ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["POLICY"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Name"]},": ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["pii_restricted"]}," (or your own naming)"]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-2-attach-the-tag-to-pii-columns","__idx":3},"children":["Step 2. Attach the tag to PII columns"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Data Workbench"]},", select the Parent Segment output database (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["cdp_audience_<id>"]},") → table ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["customers"]}," → ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Schema"]}," tab → ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Edit Schema"]},". On each PII column (email, phone, etc.), set ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Accessibility = ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["pii_restricted"]}]},", then ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Save"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The tag now follows the column. It survives Parent Segment refresh and re-binds to the rebuilt table by logical name."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning","name":"Tag PII in source tables too"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Tags are attached per column on a specific table; they do not propagate from the Parent Segment output table back to its source tables. If the policy in ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#step-3-create-the-access-policy"},"children":["Step 3"]}," grants the restricted user ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Query Only"]}," access to source databases — which is required when an agent may query source tables — repeat the tagging above on every source table that contains the same PII columns. Untagged source columns will return plaintext and bypass the masking applied to the Parent Segment output."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-3-create-the-access-policy","__idx":4},"children":["Step 3. Create the access policy"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Navigate to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Control Panel"]}," → ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Policies"]}," → ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Add Policy"]}," and name it (e.g. ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["pii_deny"]},")."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In the new policy, on the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Permissions"]}," tab:"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"data-workbench-panel","__idx":5},"children":["Data Workbench panel"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Database permissions"]},": Limited"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Add the Parent Segment output database and any related source database with ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Query Only"]},"."]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning","name":"Do not select Full or Edit"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Granting ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Full"]}," or ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Edit"]}," access on a database bypasses column masking. Use ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Query Only"]}," to keep masking in effect."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"column-level-access-control-panel","__idx":6},"children":["Column Level Access Control panel"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Scroll to the bottom of the Permissions panel and select the pencil icon."]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Policy default accessibility"]},": View"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Per-tag rule"]},": tag = ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["pii_restricted"]},", accessibility = ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Masked"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Save"]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For the full reference on this panel, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/control-panel/security/policies/policy-based-column-level-access-control-permissions"},"children":["Policy Based Column Level Access Control Permissions"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"llm-project-panel","__idx":7},"children":["LLM Project panel"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Set this based on which agents the restricted users should be allowed to chat with. Typically ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Limited"]},", so they can use a custom safe agent but cannot chat with the default Treasure AI-Managed Audience Agent."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-4-assign-the-policy-to-the-users","__idx":8},"children":["Step 4. Assign the policy to the user(s)"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In the policy: ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Users"]}," tab → add the restricted user."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Then remove that same user from the auto-generated ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Columns full"]}," policy (",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Control Panel"]}," → ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Policies"]}," → ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Columns full"]}," → ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Users"]}," → remove)."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning","name":"This step is mandatory"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Treasure AI evaluates permissions additively (most-permissive wins). As long as the user is on ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Columns full"]},", the new policy is overridden and masking does nothing."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-5-verify-sql-behavior","__idx":9},"children":["Step 5. Verify SQL behavior"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Sign in as the restricted user. Run:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"sql","header":{"controls":{"copy":{}}},"source":"SELECT customer_id, email, phone\nFROM customers\nLIMIT 5\n","lang":"sql"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Expected:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["customer_id"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["loyalty_tier"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ltv"]},": plaintext"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["email"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["phone"]},": SHA-256 hashes"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If you see plaintext PII, the user is still on ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Columns full"]}," or has Full access on the database. If everything is denied, recheck the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Column Level Access Control"]}," panel in your policy — the per-tag rule should be set to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Masked"]}," with the policy default left at ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["View"]},". See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/control-panel/security/policies/policy-based-column-level-access-control-permissions"},"children":["Policy Based Column Level Access Control Permissions"]}," for the full reference."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-6-make-the-agent-honor-the-same-restriction-optional","__idx":10},"children":["Step 6. Make the agent honor the same restriction (optional)"]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning","name":"Do not rely on this step alone"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The prompt-level guardrails configured in this step are ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["non-deterministic"]}," and can be bypassed by prompt injection. They are defense-in-depth, not a primary control. Always pair them with the column-level masking configured in ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#step-1-create-a-policy-tag"},"children":["Steps 1–5"]},", which is the deterministic control that prevents PII from reaching an external LLM provider."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The default Treasure AI-Managed Audience Agent attached to the Parent Segment respects the column tag. Add the prompt below for additional prompt-level guardrails on a custom agent built in AI Agent Foundry or a custom skill on Treasure AI Studio. You can also include this instruction in the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["query_database"]}," tool."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["In the AI Agent Foundry custom agent system prompt, add a directive like:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"You must never query, retrieve, return, decode, or reference PII columns\nlike email, phone, contact details, or address.\n\nIf a user asks for them, refuse politely and explain they are restricted.\nNever issue a query to get any details about PII columns.\n"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-7-verify-agent-behavior-optional","__idx":11},"children":["Step 7. Verify agent behavior (optional)"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["As the restricted user, chat with the custom agent. Ask innocuous questions and probing ones (for example, \"show me a few customer emails\", \"list all data for customer 1001\"). The agent should answer non-PII questions normally and refuse PII requests."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If the agent does issue any query with PII, it returns hashed values — meaning no PII is sent to the LLM model provider."]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Agent does not issue a query for PII"]}," → no PII in LLM context → no PII sent to the LLM provider during model inference. Requirement satisfied."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"img","attributes":{"src":"/assets/configure-column-level-access-control-agent-refuses-pii.99f82a60c1b6863fc32fe7a5b1fe9c822882faf2d134a965ea1f9b13a0c05edb.91c26685.webp","alt":"Custom Audience Agent refusing to share PII when asked for contacts or zipcodes"},"children":[]}]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Agent issues a query"]}," → only masked values of PII are returned. Requirement satisfied."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"img","attributes":{"src":"/assets/configure-column-level-access-control-agent-returns-hashed-pii.4c80d338611809e2a34cef7c35d4dd85194fee615c150a65b3199d871d36ef59.91c26685.webp","alt":"Agent returning SHA-256 hashed values for phone and email columns"},"children":[]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"related","__idx":12},"children":["Related"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/control-panel/security/tag-management/about-column-level-access-control"},"children":["About Column Level Access Control"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/control-panel/security/policies/policy-based-column-level-access-control-permissions"},"children":["Policy Based Column Level Access Control Permissions"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/ai-studio/security/access-control"},"children":["AI Studio — Access Control"]}]}]}]},"headings":[{"value":"Configure column-level access control to keep PII out of LLMs","id":"configure-column-level-access-control-to-keep-pii-out-of-llms","depth":1},{"value":"Prerequisites","id":"prerequisites","depth":2},{"value":"Step 1. Create a policy tag","id":"step-1-create-a-policy-tag","depth":2},{"value":"Step 2. Attach the tag to PII columns","id":"step-2-attach-the-tag-to-pii-columns","depth":2},{"value":"Step 3. Create the access policy","id":"step-3-create-the-access-policy","depth":2},{"value":"Data Workbench panel","id":"data-workbench-panel","depth":3},{"value":"Column Level Access Control panel","id":"column-level-access-control-panel","depth":3},{"value":"LLM Project panel","id":"llm-project-panel","depth":3},{"value":"Step 4. Assign the policy to the user(s)","id":"step-4-assign-the-policy-to-the-users","depth":2},{"value":"Step 5. Verify SQL behavior","id":"step-5-verify-sql-behavior","depth":2},{"value":"Step 6. Make the agent honor the same restriction (optional)","id":"step-6-make-the-agent-honor-the-same-restriction-optional","depth":2},{"value":"Step 7. Verify agent behavior (optional)","id":"step-7-verify-agent-behavior-optional","depth":2},{"value":"Related","id":"related","depth":2}],"frontmatter":{"seo":{"title":"Configure column-level access control to keep PII out of LLMs","description":"Use Treasure AI Column-Level Access Control to mask PII in Audience Studio and Data Workbench while preventing PII from reaching external LLM providers when AI Agent Foundry agents run inference."}},"lastModified":"2026-05-26T19:14:04.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/products/customer-data-platform/ai-agent-foundry/security/configure-column-level-access-control-for-pii","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}