Airtable: Redact PII in Record Reads

What this policy does

Direction: egress (tool_post_invoke) Default: allow (transform-only — never denies) Package: airtable.egress.redact_pii

What it does

Scans the responses of the Airtable record-read tools — the calls that return row fields values — and rewrites high-confidence PII shapes to a fixed [REDACTED] token before the response reaches the agent:

Matches are replaced in place, leaving the surrounding record structure (record IDs, field names, table/base IDs, JSON scaffolding) intact so the response stays usable. The policy is transform-only: it never denies a call, and responses with no matches (and all out-of-scope tools) pass through unchanged. Every response field is read via object.get, so missing or oddly-shaped payloads are never an error — they simply pass through.

Redaction operates on the response payload only and never alters stored records — the row in Airtable is untouched; only the copy handed to the agent is masked.

Because Airtable bases routinely hold CRM contacts, ATS candidate rows, and — on HIPAA-eligible Enterprise — patient-ops data, a single list_records* call can dump an entire table. That makes the record-read path the primary PII-egress surface for Airtable, which is why this policy sits on egress.

Group exemption

Callers whose IdP groups claim contains the placeholder data-privileged group (see Known limitations) receive unmasked responses. The check reads input.subject.claims.groups via object.get chains: a missing subject, missing claims, or missing groups claim means the caller is not exempt and redaction applies — the grant fails closed. This failure mode is safe: a caller whose claims fail to arrive gets over-redaction, never disclosure.

Compliance alignment

• SOC 2 CC6.7 — supports restricting the transmission/movement of confidential information by masking direct identifiers in Airtable record content as it leaves the gateway toward the agent.
• SOC 2 C1.1 — supports identification and protection of confidential information on the read path; P4.1 — supports limiting personal information use to identified purposes; P6.1 — supports controls over personal-information disclosure by keeping raw identifiers out of agent context that does not need them.
• GDPR Art. 5(1)(c) — data minimisation on agent reads of personal data; Art. 9 — reduces special-category exposure on the MCP path where identifiers co-occur with health/HR content in a base; Art. 5(1)(f) / Art. 32 — supports security of processing.
• CCPA/CPRA §1798.121 — supports limiting the use and disclosure of sensitive personal information (SSN, national-ID numbers) on the agent channel; §1798.150 — reduces nonredacted-PI breach exposure.

Why egress

The PII already lives in the base — there is nothing to block at ingress, and denying record reads outright would make the agent useless for everyday work. The leak happens when record fields are returned to the MCP client, so the response path is the only place to catch it while keeping the data useful. (For bases or tables that should never be read at all, pair with an ingress fence or a bulk-read clamp — see Composition.)

Tool name matching

Applies on the output path (input.mode == "output" or input.action == "tool_post_invoke" — either satisfies scope, so a gateway build that leaves one unset still redacts rather than failing open). The tool name is read from all three egress surfaces — input.resource.name (PARC), input.tool_metadata.name (legacy), and input.payload.name — and the policy matches if any of them carries a record-read suffix.

Matching is case-insensitive and by suffix, anchored with a leading hyphen so generic verbs cannot accidentally match unrelated tools once the gateway server-name prefix is stripped. The DTwo gateway prefixes tool names with the configured MCP server name (e.g. airtable-list_records_for_table), so the suffixes below include that hyphen.

The suffix set covers the record-read tools of the two verified Airtable MCP server families — the official remote server (verbose *_for_table / *_for_page names) and domdomegg's community server (terse names):

• -list_records (domdomegg) / -list_records_for_table (official)
• -search_records (both)
• -get_record (domdomegg) / -get_record_for_page (official)
• -list_records_for_page (official)
• -display_records_for_table (official interactive record widget; disabled by default on the server, covered here so it redacts safely if enabled)

Because the concise and verbose spellings differ only by suffix, each is listed explicitly (e.g. -list_records does not match -list_records_for_table, which ends in _for_table). Verify the exact names your gateway emits with the dump-input debug technique before relying on this in production, and extend pii_read_suffixes for any other record-returning tools your deployment exposes.

Response shape

The policy reads input.payload.text — the MCP content-block array the gateway populates on tool_post_invoke. Airtable record responses arrive as serialized JSON (an array of records, each with a fields object), so the regexes run over the serialized text of each string block and match values inside "Field": "value" pairs without eating the surrounding quotes (patterns are \b-anchored). It also redacts the inner text of MCP-standard structured content blocks ({"type":"text","text":"..."}), preserving every other key. When at least one block changes, the policy emits transform.transformed_payload containing the original payload with the rewritten text array (all other payload keys preserved). When nothing changes, no transform is emitted and the response passes through byte-identical.

If a gateway or tool emits payload.text as a bare string rather than a content-block array, that shape is redacted too (string in, string out — the rewrite is shape-preserving); it does not fall through unredacted.

Examples

Redacted (in-scope tool, non-exempt caller)

{
  "input": {
    "action": "tool_post_invoke",
    "mode": "output",
    "resource": { "name": "airtable-list_records_for_table", "type": "tool" },
    "subject": { "sub": "auth0|u1", "claims": { "groups": ["sales"] } },
    "payload": {
      "name": "airtable-list_records_for_table",
      "text": ["{\"records\":[{\"id\":\"rec1\",\"fields\":{\"Email\":\"jane.doe@example.com\",\"SSN\":\"123-45-6789\"}}]}"]
    }
  }
}

allow = true, with transform.transformed_payload.text = ["{\"records\":[{\"id\":\"rec1\",\"fields\":{\"Email\":\"[REDACTED]\",\"SSN\":\"[REDACTED]\"}}]}"].

Passed through (exempt caller)

{
  "input": {
    "action": "tool_post_invoke",
    "mode": "output",
    "resource": { "name": "airtable-get_record", "type": "tool" },
    "subject": { "sub": "auth0|u2", "claims": { "groups": ["data-privileged"] } },
    "payload": {
      "name": "airtable-get_record",
      "text": ["SSN 123-45-6789"]
    }
  }
}

allow = true, no transform — the data-privileged group receives raw content.

Composition

Single-purpose transform policy (default allow := true); it composes cleanly with deny/transform policies on the same pipeline. Recommended companions for apps/airtable:

• mask-pan-egress (PF-01) — cardholder-number masking is intentionally out of scope here. Pair this policy with a Luhn-validated mask-pan-egress companion so PANs in payment-tracker bases are masked to BIN+last4; this policy does not touch card numbers.
• cap-bulk-export (PF-08, ingress) — clamps maxRecords and strips filterByFormula on list_records*, throttling the mass enumeration that turns a single redaction miss into a full-table leak.
• A base/table fence (PF-23, ingress) — blocks reads of the most sensitive bases outright; redaction is the wrong tool for data no agent should read at all.

Known limitations

• rashidazarang/airtable-mcp tool names are unverified. The landscape note could not verify that 42-tool community server's per-tool names from source; its record-read tools are therefore not in the suffix set. If you run it, introspect its live tool names and add the record-read suffixes before relying on this policy against it.
• Base64 / attachment content cannot be regex-scanned. Attachment fields return URLs, and any file content fetched separately is opaque to a text-pattern policy; PII inside binary attachments passes through untouched.
• Pattern-based detection is best-effort. Conservative by design: SSNs are matched in hyphenated form only (bare 9-digit runs collide with Airtable record IDs and other numerics); phones only in E.164 or separator-formatted NANP shapes (bare 10-digit runs are not matched, and the NANP separator set is hyphen/dot/space only — a tab-, comma-, or slash-separated grouping is deliberately not matched); the national-ID class ships with the UK National Insurance shape only (uppercase) — add your jurisdictions' formats to national_id_pattern; the email pattern will also match user@host substrings inside URLs and connection strings (a documented false-positive cost). Because every pattern is \b-anchored, a value glued directly to surrounding word characters with no separator (e.g. a free-text notes field reading NotesSSN123-45-6789end) is not matched — the leading boundary fails. Obfuscated (e.g. full-width digits), split-across-blocks, spelled-out, or image-embedded values are not caught. Treat this as a high-signal minimum-necessary layer, not a complete DLP solution.
• Only string and MCP {type,text} content blocks are scanned. PII that a gateway delivers under some other structured key (a content block that is an object with no string text field, or a non-string/non-object element such as a nested array) is not scanned and passes through. If your gateway emits such shapes, flatten them upstream or add an object-aware redaction step.
• Only array and bare-string payload.text shapes are scanned. The two transform rules fire when payload.text is a content-block array or a bare string. If a gateway delivers the top-level payload.text as some other container (for example an object like {"content": "..."}), neither rule matches and the response passes through unredacted. This is not a shape the documented tool_post_invoke schema emits, but confirm your gateway's actual egress shape with the dump-input technique before relying on this.
• Comment reads are out of scope. This policy scans record-read tools only. Comment-read surfaces (list_comments, and any *recordComments*-style reads on the official server) can carry customer emails/phones in comment bodies and are not redacted by this policy. If your agents read Airtable comments, add the comment-read suffixes to pii_read_suffixes or attach a companion egress redaction policy scoped to them.
• Suffix matching assumes the hyphen server-name prefix. The suffix set is anchored with a leading hyphen (-list_records), matching the documented gateway naming <server-name>-<tool-name>. A deployment that joins the prefix with a different separator, or exposes an unprefixed bare tool name, will not match and the response will pass through unredacted. Confirm the emitted names with the dump-input technique and adjust pii_read_suffixes.
• Group names are placeholders — replace data-privileged with your IdP's group name at import time. The exemption expects the groups claim as an array of strings (a single bare string is also handled); a claim that is neither (e.g. an object) fails closed → redaction applies. If your IdP emits roles under a namespaced claim, adjust caller_groups. Missing claims always mean redaction applies — the failure mode is over-redaction, not disclosure.
• Egress transformed_payload replaces the response payload wholesale. Verify the rewrite against your gateway version with the dump-input technique before production, and mind attachment order if other egress transforms (for example the mask-pan-egress companion) run on the same pipeline.

Compliance note. This policy supports alignment with the cited framework controls on the MCP path only. No policy or bundle makes an organization compliant with any framework; web-UI, native-API, and in-app access are outside the gateway's reach by design. Validate against your own compliance program before relying on it.

Policy source (Rego)

package airtable.egress.redact_pii

# Transform-only egress policy: rewrites US SSNs, email addresses, phone
# numbers (E.164 + NANP), and national-ID numbers in Airtable record-read
# responses to a fixed [REDACTED] token before the response reaches the agent.
# Never denies, and never touches the stored record — only the response copy.
# Callers in the placeholder `data-privileged` IdP group receive unredacted
# responses; the group check fails closed, so a caller with missing or
# oddly-shaped claims gets over-redaction, never disclosure.
default allow := true

# -----------------------------------------------------------------------------
# Scope: the record-read tools of the two verified Airtable MCP server families
# (official remote server: verbose `*_for_table` / `*_for_page` names;
# domdomegg community server: terse names). The gateway prefixes tool names
# with the configured MCP server name (e.g. `airtable-list_records_for_table`),
# so we match by suffix; the leading hyphen keeps generic verbs from matching
# unrelated tools once the prefix is stripped. Concise and verbose spellings
# differ only by suffix, so each is listed explicitly.
# -----------------------------------------------------------------------------

pii_read_suffixes := {
    # domdomegg community server (terse) / official remote server (verbose)
    "-list_records",
    "-list_records_for_table",
    "-list_records_for_page",
    "-search_records",
    "-get_record",
    "-get_record_for_page",
    # Official interactive record widget (records-returning; disabled by
    # default, but redacts safely when enabled). Distinct suffix from
    # -list_records_for_table, so it must be listed explicitly.
    "-display_records_for_table",
}

# Egress scope: match the post-invoke/output path on either mode or action. If
# we keyed on input.mode alone and a gateway build left it unset,
# is_pii_read_tool would silently fail and redaction would no-op (fail open,
# leaking content). Ingress (tool_pre_invoke / mode "input") satisfies neither
# branch, so it stays out of scope.
is_egress if { input.mode == "output" }

is_egress if { input.action == "tool_post_invoke" }

# The tool name is exposed on egress under resource.name (PARC),
# tool_metadata.name (legacy), and payload.name (tool-hook canonical). Collect
# all three and match if ANY carries a record-read suffix — matching only a
# subset would let a gateway that populates a different surface slip content
# past the scanner.
candidate_names contains lower(object.get(object.get(input, "resource", {}), "name", ""))

candidate_names contains lower(object.get(object.get(input, "tool_metadata", {}), "name", ""))

candidate_names contains lower(object.get(object.get(input, "payload", {}), "name", ""))

is_pii_read_tool if {
    is_egress
    some suffix in pii_read_suffixes
    some n in candidate_names
    endswith(n, suffix)
}

# -----------------------------------------------------------------------------
# Group exemption — placeholder IdP group whose members receive unredacted
# responses. Replace "data-privileged" with your IdP's group name at import
# time. Claims are read via object.get(input.subject, "claims", {}); the
# object.get chains mean a missing subject/claims/groups claim is never
# exempt: the grant fails closed and redaction applies.
# -----------------------------------------------------------------------------

exempt_groups := {"data-privileged"}

caller_claims := object.get(object.get(input, "subject", {}), "claims", {})

caller_groups := object.get(caller_claims, "groups", [])

is_exempt if {
    # Only an array of group strings grants the exemption. The is_array guard
    # is load-bearing: `some g in caller_groups` over an OBJECT iterates its
    # values, so a namespaced/metadata claim like {"department": "sales"} would
    # else wrongly exempt the caller. is_string(g) keeps nested/non-string
    # elements from matching. Anything but a clean array of strings fails
    # closed -> redact.
    is_array(caller_groups)
    some g in caller_groups
    is_string(g)
    lower(g) in exempt_groups
}

is_exempt if {
    # Some IdPs emit a single group as a bare string rather than an array.
    is_string(caller_groups)
    lower(caller_groups) in exempt_groups
}

# -----------------------------------------------------------------------------
# Detection patterns — anchored and conservative to limit false positives on
# Airtable record IDs (rec...), base/table IDs (app.../tbl...), and dates.
# -----------------------------------------------------------------------------

# Standard email address shape: local part, @, domain, 2+ letter TLD. Word-
# boundary anchored so it never fires inside longer alphanumeric runs and never
# eats the surrounding JSON quotes.
email_pattern := `\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b`

# US SSN in the canonical hyphenated form only. Bare 9-digit runs collide with
# record IDs and raw numeric fields, so they are deliberately not matched.
ssn_pattern := `\b\d{3}-\d{2}-\d{4}\b`

# National-ID class: UK National Insurance number — two prefix letters
# (excluding D, F, I, Q, U, V), six digits, suffix letter A-D. Uppercase only;
# add your jurisdictions' national-ID shapes alongside this one.
national_id_pattern := `\b[A-CEGHJ-PR-TW-Z]{2}[0-9]{6}[A-D]\b`

# E.164 international numbers: a leading + and 8-15 contiguous digits, the first
# non-zero. Anchored on the + so it never matches bare digit runs / IDs.
e164_pattern := `\+[1-9]\d{7,14}\b`

# Separator-formatted NANP phone numbers (e.g. 206-555-0100, (206) 555-0100,
# (206)555-0100, +1 206.555.0100). A parenthesized area code may be followed by
# an optional separator; a bare area code still requires a separator, so bare
# 10-digit runs are deliberately not matched.
nanp_pattern := `(?:\+?1[-. ])?(?:\(\d{3}\)[-. ]?|\b\d{3}[-. ])\d{3}[-. ]\d{4}\b`

# -----------------------------------------------------------------------------
# Redaction steps — each is total over strings (regex.replace returns the input
# unchanged when its pattern doesn't match), so the steps chain safely. Every
# class maps to the same [REDACTED] token per the policy spec.
# -----------------------------------------------------------------------------

redact_emails(t) := regex.replace(t, email_pattern, "[REDACTED]")

redact_ssns(t) := regex.replace(t, ssn_pattern, "[REDACTED]")

redact_national_ids(t) := regex.replace(t, national_id_pattern, "[REDACTED]")

redact_e164(t) := regex.replace(t, e164_pattern, "[REDACTED]")

redact_nanp(t) := regex.replace(t, nanp_pattern, "[REDACTED]")

# Order matters: emails first, so the digit patterns can never half-eat a
# digit-bearing local part; then SSNs (tightest digit shape), national IDs
# (alphanumeric, disjoint from the digit patterns), E.164 (anchored on +), and
# separator-formatted NANP last (loosest).
redact_text(t) := redact_nanp(redact_e164(redact_national_ids(redact_ssns(redact_emails(t)))))

# Helper: the inner `text` string of an MCP structured content block
# ({"type":"text","text":"..."}); undefined for anything else.
block_text(b) := t if {
    is_object(b)
    t := object.get(b, "text", null)
    is_string(t)
}

# Plain-string content blocks: redact in place.
redact_block(b) := redact_text(b) if {
    is_string(b)
}

# MCP-standard structured text content blocks {"type":"text","text":"..."}:
# redact the inner `text` string and preserve every other key (type,
# annotations). Without this branch, record content delivered as content-block
# OBJECTS (a canonical MCP wire shape) would slip past a string-only redactor
# untouched — the exact PII this policy targets, leaked verbatim.
redact_block(b) := object.union(b, {"text": redact_text(bt)}) if {
    not is_string(b)
    bt := block_text(b)
}

# Any other block — an object with no string `text` field, or a non-string /
# non-object value — passes through unmodified. The policy makes no claim over
# arbitrary structured data whose PII lives under other keys.
redact_block(b) := b if {
    not is_string(b)
    not block_text(b)
}

# -----------------------------------------------------------------------------
# Transform — emitted only when in scope, the caller is not exempt, and at
# least one block actually changed. Otherwise the rule is undefined and the
# aggregator skips this policy, returning the response byte-identical.
# -----------------------------------------------------------------------------

response_payload := object.get(input, "payload", {})

text_blocks := object.get(response_payload, "text", [])

redacted_blocks := [out |
    some block in text_blocks
    out := redact_block(block)
]

transform := {
    "transformed_payload": object.union(response_payload, {"text": redacted_blocks}),
} if {
    is_pii_read_tool
    not is_exempt
    is_array(text_blocks)
    redacted_blocks != text_blocks
}

# Some gateways/tools emit `payload.text` as a bare string rather than a
# content-block array. Redact that shape too (string in, string out — the
# rewrite is shape-preserving) so PII is not leaked on this fail-open path.
# Mutually exclusive with the array rule above (is_string vs is_array), so the
# two complete-value transform rules never both fire.
transform := {
    "transformed_payload": object.union(response_payload, {"text": redacted_text}),
} if {
    is_pii_read_tool
    not is_exempt
    is_string(text_blocks)
    redacted_text := redact_text(text_blocks)
    redacted_text != text_blocks
}

Canonical source: policy.md on GitHub · raw · raw on this site (.md)

Related policies