Salesforce Decode
Salesforcedecode
Back to questions
AgentforceAdvancedeinstein-trust-layerpiimaskingcompliance

Configure Einstein Trust Layer for agent PII masking and audit

Real World Scenario

A bank agent must access account balances without sending full account numbers or SSN fragments to the external LLM. Auditors require proof of what data crossed the trust boundary.

Expected Answer

• Enable Trust Layer data masking for defined sensitive field patterns before LLM prompts • Use secure data retrieval actions that return masked values to the model and full values only server-side • Audit Trust Layer logs showing masked vs unmasked field handling per session • Align retention policies for prompt/response logs with banking regulatory requirements • Test that jailbreak attempts cannot reconstruct masked values from action side channels • Document data residency and model provider agreements for cross-border deployments • Separate dev/test orgs with synthetic data—never copy production PII to sandbox for agent tuning

Follow-Up Questions & Answers

Click to expand — each follow-up includes a direct, interview-ready answer

Direct answer: Enable Trust Layer data masking for defined sensitive field patterns before LLM prompts Also consider: Use secure data retrieval actions that return masked values to the model and full values only server-side In practice: Audit Trust Layer logs showing masked vs unmasked field handling per session Optimize for scale and operational observability.

Architect Perspective

Trust Layer is necessary but not sufficient—architects still validate that actions and custom integrations do not bypass masking by concatenating sensitive data into prompts.