Fail-closed PII ingestion gateWIP
CAIO Vault Gate
A security ingestion gate that re-scans PII regardless of source declarations, quarantines uncertainty, and never logs sensitive values.
Internal operations tool, so the case study uses architecture and representative screens instead of a public URL.
Overview
CAIO Vault Gate is a PII ingestion gate that independently re-scans material before it enters the knowledge base.
It does not trust upstream declarations. Payloads move through contract validation, PII scan, sensitivity tiering, and deduplication. Tests cover unicode, homoglyph, and spread-evasion payloads, while logs are fixed to avoid storing sensitive values.
Its strength is the fail-closed design. Only clearly safe data passes through; uncertainty is quarantined for operator review.
Core skills
Sensitive-data detection and fail-closed routing
Unicode, homoglyph, and spread-evasion red-team testing
Contract validation, PII scan, sensitivity tiering, and deduplication
Implementation
- 1Validated ingestion contracts before routing through PII scan, sensitivity tiering, and deduplication.
- 2Used NFKC normalization and Luhn checks to separate email, phone, ID-like, and card-like patterns.
- 3Iterated with red-team payloads while fixing logs to store only type names and counts, never values.
Strengths
- Reduces trust in upstream declarations by independently rescanning every payload.
- Reduces operating incidents by quarantining uncertain data instead of passing it through.
- Tests cover adversarial inputs close to real evasion attempts.
Metrics
126
tests
3
red-team rounds
6
PII types
0
logged values
Tech stack
Python 3.13pytestPyYAMLNFKCLuhn
Screenshots
