Strategy for avoiding PII data?

[kaihendry]

I'm working with a large Datadog instance that has customer(s) PII in it that we don't want to surface when we drive pup from Claude. Do you have tips to filter out or disallow certain queries?

[platinummonkey]

that might be rather difficult as is with true certainty, given that an agent could ignore or accidentally query a field that contains PII. This might itself be worth a feature within pup or directly into individual product API surfaces for PII redaction on query. Alternatively you can wrap pup's output with your own script to redact before giving back to the agent?

Ideally use SDS filtering on ingest to redact PII while ingesting to avoid the query path all together.

[kaihendry]

Was thinking it might be a nice feature inside pup itself, to allowlist certain logs queries / mask some attributes. An additional layered control which is always appreciated in the Enterprise.

[platinummonkey]

How would you envision that functioning?