>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3577498. --> Reported by: [breidert](https://www.drupal.org/user/135619) >>> <p>[Tracker]<br> <strong>Update Summary: </strong>[One-line status update for stakeholders]<br> <strong>Check-in Date: </strong>MM/DD/YYYY<br> <strong>Additional Collaborators: </strong><br> <em>Metadata is used by the <a href="https://www.drupalstarforge.ai/" title="AI Tracker">AI Tracker.</a> Docs and additional fields <a href="https://www.drupalstarforge.ai/ai-dashboard/docs" title="AI Issue Tracker Documentation">here</a>.</em><br> [/Tracker]</p> <h2>Overview</h2> <p>This meta issue covers the creation of a Drupal Recipe (<code>ai_recipe_guardrails_pii</code>) that ships sensible default guardrail configuration for detecting and blocking Personally Identifiable Information (PII) in AI interactions.</p> <p>The recipe builds on the guardrail plugin system introduced in <a href="https://www.drupal.org/project/ai/issues/3518963">#3518963</a> and provides a zero-configuration starting point for GDPR and privacy compliance.</p> <p>Once the recipe is installed all AI interactions are immediately protected against common PII exposure patterns &mdash; both in user input sent to an LLM and in LLM output returned to users.</p> <p>The guardrails provided are deterministic regex checks, meaning they add no LLM cost and introduce negligible latency.</p> <h2>Use Cases</h2> <p>The recipe protects against the following PII exposure scenarios:</p> <ul> <li>Email addresses: A user submits a prompt containing an email address that then gets logged, stored in conversation history, or forwarded to a third-party LLM provider. On the output side, an LLM may reconstruct or leak an email address from injected context or RAG sources.</li> <li>Phone numbers: Users may inadvertently or intentionally include phone numbers in prompts. LLM responses may similarly surface them from context.</li> <li>Credit card numbers: A user may paste payment details into a prompt. An LLM should never reproduce anything resembling a credit card number in its output regardless of how it got there.</li> <li>IBAN / bank account numbers: Particularly relevant for European sites &mdash; users may include bank details in prompts, or an LLM might surface them from financial documents used as RAG context.</li> </ul> <p>All patterns are checked in both directions: on user input before it is sent to the LLM, and on LLM output before it is returned to the user.</p> <h3 id="summary-ai-usage">AI usage (if applicable)</h3> <p>[x] AI Assisted Issue<br> This issue was generated with AI assistance, but was reviewed and refined by the creator.</p> <p>[ ] AI Assisted Code<br> This code was mainly generated by a human, with AI autocompleting or parts AI generated, but under full human supervision.</p> <p>[ ] AI Generated Code<br> This code was mainly generated by an AI with human guidance, and reviewed, tested, and refined by a human.</p> <p>[ ] Vibe Coded<br> This code was generated by an AI and has only been functionally tested.</p> > Related issue: [Issue #3577506](https://www.drupal.org/node/3577506)