PII Masking
Status: Ineffective contract: the installed NexoPIIMasking CRD exposes no masking fields, so it cannot express an enforceable policy.
:::caution No supported deployment contract
This capability is documented for catalog completeness, but the selected release does not publish a supported end-to-end deployment contract.
:::
Always confirm availability in the release bundle selected for deployment.
At a glance
| Property | Value |
|---|---|
| Pipeline phase | Response |
| Category | Compliance |
| Canonical minimum tier | Pro |
| Canonical entitlement | Yes |
| Supported deployment contract | No |
| Release status | Ineffective contract: the installed NexoPIIMasking CRD exposes no masking fields, so it cannot express an enforceable policy. |
Release accuracy
- Current documentation: Ineffective contract: the installed NexoPIIMasking CRD exposes no masking fields, so it cannot express an enforceable policy.
Where any detail below conflicts with the release status above, the release status is authoritative. Field names and examples describe the current dashboard and CRD surface; always confirm behavior against the selected release bundle before relying on it operationally.
Release-aware feature flow. The diagram is explanatory; the release status on this page is authoritative.
Diagram resources: Open the SVG full screen · Download the editable Excalidraw source
Performance impact
:::warning Unverified performance figures
These figures are illustrative only. They are not current benchmarks or service guarantees and have not been verified by the current test suite.
:::
| Percentile | Reported figure |
|---|---|
| P50 | <0.5ms |
| P95 | <1ms |
| P99 | <2ms |
Note: Linear scan of response fields — heavier for large documents
Overview
The runtime contains a PII-masking implementation, but the installed NexoPIIMasking CRD schema exposes no configurable masking fields. An accepted empty object cannot deliver fields, patterns, namespace scopes, failure policy, or other masking configuration to the runtime.
The current release therefore does not provide a supported end-to-end masking contract.
When to use
- Understanding the intended future masking capability
- Evaluating the current empty-schema limitation before planning sensitive-data controls
How it works
- The installed CRD accepts an empty spec object.
- No masking fields can be expressed through that schema.
- The Operator therefore cannot deliver an enforceable masking policy from the installed contract.
- A Ready resource must not be interpreted as proof that response data is masked.
Configuration
“Not specified” means required semantics were not declared for that field.
| Field | Type | Default | Required | Description |
|---|
Settings reference
No additional settings reference is documented for this component.
Examples
No example is documented for this component.
Best practices
- Use an independently verified masking control for current production data
- Do not infer masking from CRD admission, Ready status, or pipeline inclusion
- Require an end-to-end leak test before depending on a future release
Limitations
- The installed CRD schema exposes no configurable masking fields
- No deployable masking example is published for the current release
Security and operational guidance
- Do not route sensitive production data relying on the current empty CRD schema
- Apply masking in the application, database, or another independently verified control
- Wait for a tested CRD-to-runtime contract before using the runtime capability
Related steps
Release availability
- Current documentation: Ineffective contract: the installed NexoPIIMasking CRD exposes no masking fields, so it cannot express an enforceable policy.
See the component catalog for the complete comparison matrix.