Skip to main content

Reversible masking

Keep sensitive values away from a model, then restore them only inside an allowed trust context. Trinitite replaces each detected value with a flow-scoped token such as <TRT::pii_email::A3F9C0>.

Status: Beta Companion docs: Masking API · Verdicts and modes · Receipts Source of truth: Masking API. This guide is the Python SDK projection.

Choose a masking preset​

Five system presets are available: off, essential, standard, strict, and maximum.

from trinitite import Trinitite

tr = Trinitite(env="prod")
tr.govern(frameworks=["soc2"], masking_preset="strict")

resp = tr.client("openai", credential="cred_openai_prod").chat.completions.create(
    model="gpt-4o",
    messages=[{
        "role": "user",
        "content": "Email the receipt to dana@example.com.",
    }],
)
result = tr.result(resp)

print(result.verdict)
print(result.flow_id)
print(result.mask_manifest_hash)

Omitting masking_preset inherits the next policy level. A custom preset is referenced by its bare name.

presets = tr.masking.presets()
presets.create(
    "finance-strict",
    source="strict",
    label="Finance strict",
)

tr.govern(frameworks=["soc2"], masking_preset="finance-strict")

Custom preset names are lowercase alphanumeric with hyphens, 3 to 32 characters. source clones a system preset. Use policy={...} instead to provide a complete policy body.

Rehydrate output​

Use the flow id and manifest hash returned with the governed result. result.unmask(...) supplies both for you.

masked_text = resp.choices[0].message.content
unmasked = result.unmask(masked_text)

if not unmasked.ok:
    raise RuntimeError(unmasked.body)

print(unmasked.body["text"])

The root method is useful when you stored the flow fields separately:

unmasked = tr.unmask(
    masked_text,
    flow_id=result.flow_id,
    manifest_hash=result.mask_manifest_hash,
)

The default trust context is caller_egress.

Inspect or shred a flow​

The flow manifest is hash-only. It does not return cleartext.

manifest = tr.masking.manifest(result.flow_id)
assert manifest.ok

shredded = tr.masking.shred(result.flow_id)
assert shredded.ok

Shredding removes the flow secret. Later unmask calls return the text unchanged and report unresolved tokens in the response instead of producing a server error.

Allow a model-side callback​

Enable this only when a model-side tool must restore values. The token is flow-bound, category-scoped, expires, and can be revoked.

policy = tr.masking.policy().update(
    allow_agent_callback=True,
    trust_contexts=["caller_egress", "agent_callback"],
)

token = tr.masking.mint_agent_callback_token(result.flow_id)
token_id = token.body["token_id"]

restored = tr.unmask(
    masked_text,
    flow_id=result.flow_id,
    manifest_hash=result.mask_manifest_hash,
    trust_context={
        "source": "agent_callback",
        "token": token.body["token"],
    },
)

tr.masking.revoke_agent_callback_token(result.flow_id, token_id)

Next steps​

  • Human review: route gray-zone decisions to a person.
  • Receipts: verify the signed decision linked to a masked flow.
  • Observability: replay and export governed calls.
Last updated on