Context
Privacy tooling becomes risky when it looks broader than it really is. mastra-pii rejects ner and model layer requests outright — the package owns integration, and layer choice belongs to the deployment, not the package.
Decision
The first public release stays local and deterministic, built around bounded entity coverage, stable placeholders, custom regex hooks, and a generic fail-closed marker when redaction cannot be completed safely.
Alternatives considered
- Introduce model-backed NER in the first release.
- Present the package as a broader document-redaction system before evaluation evidence is public.
Those options would expand the trust surface faster than the public evidence can support.
Consequences
The package is easier to explain, integrate, and review. The tradeoff is intentionally narrower coverage, but the public interface remains honest about what it can and cannot guarantee. The boundary set here became permanent API behavior: the deterministic layer ships in the package and doubles as the outage fallback, while NER is a deployment-side capability the package never gates or configures.