CIO questions · Security & governance
How do I prevent an LLM from seeing sensitive data?
The short answer
Control sensitive data before the model call, not merely through prompting. Detect and pseudonymize data, enforce access policies and rehydrate only at the authorized boundary when necessary. Onni's reference design applies DLP before the LLM call and rehydration at the tool boundary.
How to decide
- Detect and pseudonymize before the model call
- Enforce access by identity and by row
- Rehydrate only at the authorized tool boundary
The Onni principle
Control data before the model, not in the prompt.
The architecture behind it
- Identity
- RLS
- DLP
- Tool boundary
- Audit