AWSAWS Certified Generative AI Developer - Professional2026-103.2 Implement data security and privacy controls
Preserve useful context while removing identifiers
Completed by the knowledge check
Learning objective
Choose redaction, anonymization, or masking based on privacy requirements and impact on FM utility.
Core idea
For an architect preparing data for a foundation model (FM), the right privacy transformation preserves only the information the task needs. Removing an email address can leave a support summary useful. Removing every date can destroy the sequence needed to explain a missed deadline. Retaining an identifier for convenience can expose information that the model never needed.
Define the intended disclosure and the required utility before choosing a replacement format. Redaction, masking, and anonymization describe different privacy outcomes, but service terminology can overlap. In particular, a feature called ANONYMIZE does not by itself establish that a person cannot be identified from the remaining context.
See 3.2.6 for detection boundaries. This lesson starts with detected spans and asks what the next consumer is permitted to receive.
How it works
Define the information that must survive
List the facts necessary to complete the task: event sequence, relationships between speakers, product versions, amounts, or account ownership verified outside the model. Separate them from direct identifiers such as a name or email address. Also identify combinations that can reveal a person even without a direct identifier, such as a rare job role and a specific incident date.
Use these terms as an application contract:
- Redaction removes a sensitive value from the material released to a consumer. A replacement marker can show where information was removed without retaining the value.
- Masking obscures a value in a representation or view. The original can still exist elsewhere, so protection depends on who can recover or reveal it.
- Anonymization aims to prevent identification from the released data, including identification through remaining context or linkage. It requires an assessment of the resulting dataset, not only replacement of named entities.
A stable surrogate such as PERSON_A can preserve relationships across a conversation. If your application retains a mapping back to the person, treat the result as pseudonymized data. The surrogate reduces disclosure to the model but does not remove the privacy obligations of the mapping or the surrounding text. This is an application design choice rather than a promise made by a PII detector.
Choose transformations by consumer. A summary model may need speaker roles but no contact information. A delivery tool may need the verified address, while the conversational model needs only confirmation that the address exists. Keep that value in the authorized tool path instead of adding it to model context solely to make routing easier.
Use Comprehend replacement controls
For supported text, Comprehend StartPiiEntitiesDetectionJob accepts Mode: ONLY_REDACTION or ONLY_OFFSETS. The first produces redacted files; the second reports entity locations. When you choose ONLY_REDACTION, provide RedactionConfig including PiiEntityTypes to identify the categories to transform.
RedactionConfig.MaskMode selects MASK or REPLACE_WITH_PII_ENTITY_TYPE. With MASK, MaskCharacter replaces each character of the sensitive span. The documented mask character is one character from the allowed set, including *. Replacing characters obscures the value but can preserve its length. With REPLACE_WITH_PII_ENTITY_TYPE, the output retains the entity category rather than the original value.
A type marker can help a model recognize that a sentence contains a contact address or person reference. Character masking can make syntax harder to interpret, especially in dense documents. Neither mode supplies a stable identity mapping between repeated mentions. If a task needs that mapping, your application must create and validate it separately.
For synchronous processing, DetectPiiEntities returns detected spans and scores rather than a rewritten document. Apply transformations to the exact analyzed text using BeginOffset and EndOffset. Keep offset handling separate from later normalization so that changing whitespace or characters does not shift the replacement target.
Apply Guardrails without overstating the result
Bedrock Guardrails sensitive information filters offer blocking or masking for prompt and response text. The GuardrailPiiEntityConfig API uses actions BLOCK, ANONYMIZE, and NONE; its inputAction and outputAction fields can specify behavior for the respective directions. ANONYMIZE masks matches with identifier tags. NONE returns detection information without enforcing a transformation.
A blocked request is appropriate when the application must not process the content in that model path. A masked request can preserve useful non-sensitive text. A detection-only action can support evaluation, but it does not meet a requirement to prevent disclosure. The policy must specify the permitted action for each category and direction.
Guardrails masking uses placeholders such as {NAME} and {EMAIL}. Do not assume those tags distinguish two people or preserve a reversible mapping. Also, do not assume the transformation covers tool-call arguments, tool results, or definitions: the sensitive-information filter excludes these fields. See 3.2.9 for original values in logs and traces.
Measure privacy and utility separately
Evaluate both the transformation and the downstream answer. For privacy, test whether disallowed values survive, whether rare contextual combinations identify someone, and whether recovery mappings remain outside the model path. For utility, test whether the model preserves event order, attributes statements to the correct actor, and completes the intended task.
Use representative documents with repeated names, multiple people, overlapping detected spans, and meaningful dates. Compare outputs against reviewed answers. A large reduction in visible identifiers can coexist with incorrect summaries; a fluent summary can coexist with retained sensitive context. Neither quality result establishes the other.
AWS provides detection and replacement mechanisms, but the acceptance threshold for your privacy requirement and the utility of your chosen surrogate scheme remain application decisions. Record the transformation version alongside evaluation results so a replacement-policy change can receive the same review as a prompt change.
Key distinctions and trade-offs
Type replacement versus relationship preservation: An entity-type placeholder retains category information. A stable application surrogate preserves relationships across mentions but introduces linkage and mapping risks.
Irrecoverable release versus hidden display: Removing a value before model submission changes what the consumer receives. Hiding it in a log view leaves a recoverable original and depends on access permissions.
Detection category versus privacy outcome: Finding and replacing direct PII does not assess all contextual re-identification risks. Treat the service action name as an implementation detail, then verify the intended outcome.
Architecture / decision scenario
A support organization needs conversation summaries for trend analysis and an authorized follow-up workflow. Its first proposal masks every number and date. Evaluation shows that the summaries lose product versions and complaint timing, making them unusable.
The team instead uses Comprehend asynchronous redaction to replace selected direct identifiers with entity types. For conversations where actor identity matters, an application transformation assigns scoped speaker surrogates and stores any recovery mapping outside model context. It generalizes unnecessary identifying context according to the release policy, then evaluates whether the summaries still preserve the required event sequence.
For interactive summaries, Guardrails apply ANONYMIZE to approved sensitive categories. Inputs whose content is prohibited on that path use BLOCK. A follow-up tool receives a verified contact address through an authorized application lookup; the model receives a status rather than the address. The team separately checks that logs do not retain the raw contact value.
Common exam traps
- Treating a service’s
ANONYMIZEaction as proof of irreversible anonymization. - Assuming entity-type tags preserve the identities of multiple speakers.
- Choosing character masks without considering leaked length and lost context.
- Using
NONEwhen the requirement demands blocking or replacement. - Sending raw identifiers to the model when only an authorized tool needs them.
- Measuring answer quality without checking privacy, or checking privacy without utility.
What to remember
- Start with the consumer’s permitted disclosure and necessary task information.
- Comprehend exposes explicit redaction modes and replacement formats.
- Guardrails action names describe enforcement behavior, not a privacy certification.
- Evaluate contextual identification, relationship preservation, and answer utility independently.
Knowledge check
A model summarizes support conversations in which two customers dispute who approved a refund. The summary must attribute each statement to the right customer without exposing either name. Which transformation fits?
REPLACE_WITH_PII_ENTITY_TYPE for namesANONYMIZE on the NAME entity typePERSON_A , mapped outside the modelMASK and * as the mask characterNAME marker, and character masks hide the names without telling them apart, so the model loses who said what. Stable surrogates such as PERSON_A preserve the relationship; because a mapping exists, the result is pseudonymized and the mapping needs its own protection.A team proposes to publish chat transcripts as an anonymized research dataset because a guardrail with ANONYMIZE replaced every detected name and email. What must still be established?
BLOCK for names instead of ANONYMIZE{NAME} or {EMAIL}ANONYMIZE is an action name: it masks detected matches with identifier tags. Anonymization is an outcome that requires assessing what remains, such as a rare job role combined with an incident date. Changing the action or its direction does not perform that assessment.A guardrail policy must reject any prompt that contains a bank account number, let prompts with an email address through with the address hidden, and record phone numbers for evaluation without changing them. Which input actions fit?
ANONYMIZE for account numbers, BLOCK for emails, NONE for phone numbersBLOCK for account numbers, ANONYMIZE for emails, NONE for phone numbersBLOCK for account numbers, NONE for emails, ANONYMIZE for phone numbersBLOCK for account numbers, ANONYMIZE for emails, ANONYMIZE for phone numbersBLOCK stops content from being processed on that path, ANONYMIZE masks the match and keeps the rest of the text useful, and NONE takes no action but returns detection information. A detection-only action never satisfies a requirement to prevent disclosure.Comprehend batch redaction prepares dense technical tickets for a summarization model, which must still recognize that a removed span was an email address or a person. Which MaskMode fits?
MASK , because character masks preserve each value’s original lengthREPLACE_WITH_PII_ENTITY_TYPE , because the output keeps each entity’s categoryMASK , because a mask character marks where each value was removedREPLACE_WITH_PII_ENTITY_TYPE , because the output keeps one tag per personA delivery tool needs a customer’s verified address, while the conversational model only reports whether the delivery was scheduled. Where should the address go?