version: 1.0
description: PII Detection & Masking Rules

pii_patterns:

  - id: PII-EMAIL
    type: email
    regex: "[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}"
    action: mask

  - id: PII-PHONE
    type: phone
    regex: "\\+?[0-9]{9,15}"
    action: mask

  - id: PII-ID
    type: personal_id
    regex: "[0-9]{9,12}"
    action: mask

  - id: PII-CREDITCARD
    type: credit_card
    regex: "\\b(?:[0-9]{4}[- ]?){3}[0-9]{4}\\b"
    action: block

  - id: PII-ADDRESS
    type: address
    regex: "(street|road|district|city)"
    action: mask

default_action: allow

actions:
  mask:
    replacement: "***MASKED***"
  block:
    message: "Sensitive data detected. Request blocked."
  log:
    message: "PII detected and logged."

logging:
  enabled: true
  log_level: medium