Data protection
Restoration
How masked values are put back for the user on their device or in your application, while the AI provider and AgentID's logs keep the placeholders.
Restoration replaces placeholders in the AI's answer with the original values, so the user reads "Dear Jana Nováková" instead of "Dear <PERSON_NAME_1>". It never happens at the AI provider.
Turn it on
In Guardrails → Core Guardrails, enable Restore masked values for the end user (Beta). The switch is shown when Mask Personal Information or Mask Secrets & API Keys is on and the system is in Active Guard. It is off by default.
When it is on, an allowed Guard response contains:
{
"allowed": true,
"transformed_input": "Write to <PERSON_NAME_1> at <EMAIL_1>.",
"client_deanonymization_enabled": true,
"client_substitute_style": "tokens",
"client_placeholder_mapping": {
"<PERSON_NAME_1>": "Jana Nováková",
"<EMAIL_1>": "jana.novakova@example.com"
}
}Blocked responses never carry a mapping.
Where restoration happens
| Integration | Where originals are restored | Where the mapping is kept |
|---|---|---|
| Browser extension | In the chat page, across the whole conversation: your own messages, earlier answers, re-rendered content and history after a reload | Encrypted in the browser's local extension storage, per conversation, for 30 days after last use |
| Claude plugin (Cowork, Claude Code) | On screen, and in files Claude creates or edits; masked again when a tool reads such a file | Encrypted per-session vault on the device, kept for 7 days |
| Claude Desktop companion | In a small AgentID window that shows the answer with the originals | On the device |
| Node.js / Vercel AI SDK / Python SDK | In the result or stream returned by the wrapped call | In memory for the request |
In all cases the AI provider receives only placeholders, and AgentID's logs store the masked text.
Safety rules
- Restored text that the browser extension reads back from the page is masked again before it is sent anywhere.
- The latest prompt and answer stay masked on the page until their output has been logged, so the audit log only ever sees masked text.
- Restoration replaces only placeholders that AgentID created for this conversation or request; it does not guess.
Restoration in your own application
Official SDK wrappers restore automatically when the switch is on. You can opt out for a single integration:
const secured = agent.wrapOpenAI(openai, {
system_id: process.env.AGENTID_SYSTEM_ID!,
deanonymizeOutputForClient: false,
});secured = agent.wrap_openai(
openai,
system_id=os.environ["AGENTID_SYSTEM_ID"],
deanonymize_output_for_client=False,
)If you call the Guard API directly, keep client_placeholder_mapping in memory for the request, replace each placeholder in the model's answer, and never send the mapping to the provider or into logs:
function restore(text: string, mapping: Record<string, string> = {}): string {
return Object.keys(mapping)
.sort((a, b) => b.length - a.length)
.reduce((out, token) => out.split(token).join(mapping[token]), text);
}The Node.js SDK exposes the same logic as new PIIManager().deanonymize(text, mapping).
When to leave it off
Leave restoration off when the people or systems receiving the answer must not see the originals, for example data-minimisation deployments or answers that are forwarded to third parties. Users then see the placeholders.