---
schema_version: "1"
id: 8f3e6464f93a8eb5f2101f900cea7a4f05f3e8a1e8e2ff03280be274b2389f3e
title: A2A Personally Identifiable Information (PII) Detector Policy
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/1.13/policies-included-a2a-pii-detector.md
canonical_url: https://docs.mulesoft.com/gateway/1.13/policies-included-a2a-pii-detector
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 61c1d7236f0cd51028d17ee97a7be75a5bb7116204286aa7b40b23723f4aab47
description: MuleSoft Documentation Site
release: "1.13"
latest: false
---
---
product: Omni Gateway
version: 1.13
keywords: api gateway, flex gateway, gateway, policy
---

# A2A Personally Identifiable Information (PII) Detector Policy

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

<table><colgroup><col> <col></colgroup><tbody><tr><td><p><strong>Policy Name</strong></p></td><td><p>A2A PII Detector Policy</p></td></tr><tr><td><p><strong>Summary</strong></p></td><td><p>Detects personally identifiable information (PII) in A2A JSON-RPC traffic</p></td></tr><tr><td><p><strong>Category</strong></p></td><td><p>A2A</p></td></tr><tr><td><p><strong>First Omni Gateway version available</strong></p></td><td><p>v1.9.3</p></td></tr><tr><td><p><strong>Release Notes</strong></p></td><td><p><a href="https://docs.mulesoft.com/release-notes/gateway/policies/a2a-pii-detector-release-notes">A2A PII Detector</a></p></td></tr><tr><td><p><strong>Returned Status Codes</strong></p></td><td><p>HTTP 403 with JSON-RPC 2.0 error code <code>-32602</code> (Invalid params)</p></td></tr></tbody></table>

> [!NOTE] This policy supports Agent2Agent Protocol (A2A) version v0.3.0. To learn more about A2A
> versions, see [A2A Releases](https://github.com/a2aproject/A2A/releases).

## Summary

The A2A PII Detector policy detects personally identifiable information (PII) in A2A JSON-RPC
traffic on both the request and response sides.

On the request side, if PII is detected, you can configure the policy to reject, log, or log masked
findings. On the response side, the policy scans and logs any PII detected but never rejects or
rewrites responses. A policy violation is reported when PII is detected.

The policy supports JSON-RPC over HTTP transport and returns HTTP 403 with error code `-32602` when
rejecting requests.

## Configuring Policy Parameters

### Omni Gateway Local Mode

The A2A PII Detector policy isn’t supported in Local Mode.

### Managed Omni Gateway and Omni Gateway Connected Mode

When you apply the policy from the UI, the following parameters are displayed:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Element</th><th>Required</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p>PII Types</p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>Array of built-in PII types to detect. Supported values are <strong>Email</strong>, <strong>US SSN</strong>, <strong>Credit Card</strong>, and <strong>Phone Number</strong>. For more information, see <a href="#pii-types">PII Types</a>.</p></div></div></td></tr><tr><td><div><div><p>Custom PII Patterns</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Array of custom regex patterns to detect additional sensitive values. Define a name and regex pattern for each array entry. For example, use <code>name: AWS Access Key</code> and <code>pattern: AKIA[0-9A-Z]{16}</code> to detect AWS access keys.</p></div></div></td></tr><tr><td><div><div><p>Action</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Action to take when PII is detected. Supported values are <strong>Reject</strong>, <strong>Log</strong>, and <strong>Log and mask</strong>. Default is <strong>Log</strong>.</p></div></div></td></tr></tbody></table>

## How This Policy Works

The policy scans A2A JSON-RPC traffic for PII on both request and response sides.

### Request-Side Enforcement

The policy scans requests for these A2A JSON-RPC methods:

- `message/send`

- `message/stream`

- `tasks/get`

- `tasks/stream`

- `tasks/resubscribe`

For each request, the policy inspects these field paths in order:

1.  `params.message.parts[]` — scans each `text` JSON object

2.  `params.task.parts[]` — scans each `text` JSON object

3.  `params.task.description` — scans the string value

The policy stops scanning at the first PII detection and applies the configured action to the entire
request.

Based on the configured action:

- **Reject**: Blocks the request and returns HTTP 403 with a JSON-RPC 2.0 error response. The
  upstream never receives the request.

- **Log**: Forwards the request unchanged and logs findings with actual PII values.

- **Log and mask**: Forwards the request unchanged and logs findings with masked values.

### Response-Side Logging

On the response side, the policy scans both JSON responses and Server-Sent Events (SSE) streams:

- **JSON responses**: Scanned across multiple A2A result paths including
  `result.status.message.parts[].text`, `result.artifact.parts[].text`, `result.task.parts[].text`,
  `result.task.description`, and others.

- **SSE streams (text/event-stream)**: Each complete SSE event’s `data:` payload is scanned.

Response-side detections are always logged with raw PII values, regardless of the configured action.
Responses are never rejected or rewritten — they always pass through unchanged to the client.

The policy detects overlapping PII patterns and keeps the longest (most specific) match. For
example, a credit card number with delimiters that could also match an SSN pattern is detected as a
credit card.

## PII Types

When you configure the A2A PII Detector policy, choose which types of PII to detect.

<table><colgroup><col> <col></colgroup><thead><tr><th>PII Type</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p>Email</p></div></div></td><td><div><div><p>Standard email addresses such as <code>User.Name+tag@example.com</code>.</p></div></div></td></tr><tr><td><div><div><p>US SSN</p></div></div></td><td><div><div><p>United States Social Security Numbers (SSNs), including formats with various delimiters such as <code>123-45-6789</code>, <code>123 45 6789</code>, <code>123.45.6789</code>, <code>123,45,6789</code>, <code>123/45/6789</code>, <code>123\45\6789</code>, or <code>123456789</code>.</p></div></div></td></tr><tr><td><div><div><p>Credit Card</p></div></div></td><td><div><div><p>Credit card numbers for Visa, MasterCard, American Express, and Discover, with or without separators. Examples: <code>4111-1111-1111-1111</code>, <code>4111 1111 1111 1111</code>, <code>4111111111111111</code>, <code>4111.1111.1111.1111</code>, <code>5500-0000-0000-0004</code>, <code>3782-822463-10005</code>, <code>6011-0000-0000-0004</code>.</p></div></div></td></tr><tr><td><div><div><p>Phone Number</p></div></div></td><td><div><div><p>Phone numbers in common domestic and international formats based on ITU E.164 country codes. Examples include US numbers like <code>(555) 123-4567</code>, <code>555-123-4567</code>, <code>+1-555-123-4567</code>, and international numbers like <code>+91 98765 43210</code>, <code>+44 20 7946 0958</code>, <code>+49 30 12345678</code>.</p></div></div></td></tr></tbody></table>

## Response on Reject

When the policy blocks a request, it returns HTTP 403 with a JSON-RPC 2.0 error response.

For PII detected in `params.message.parts` or `params.task.parts`:

```json
{
  "jsonrpc": "2.0",
  "id": null,
  "error": {
    "code": -32602,
    "message": "Invalid params",
    "data": "Request contains PII data: US SSN: 123-45-6789"
  }
}
```

For PII detected in `params.task.description`:

```json
{
  "jsonrpc": "2.0",
  "id": null,
  "error": {
    "code": -32602,
    "message": "Invalid params",
    "data": "Request contains PII data in task description: US SSN: 123-45-6789"
  }
}
```

> [!NOTE] The error code is `-32602` (Invalid params) to indicate a client-side validation error.
> The `data` field is a string containing the detection details, not an object.

## Example Request and Logging

This example shows an A2A request containing multiple PII types and the corresponding log output for
different action configurations:

```json
{
  "jsonrpc": "2.0",
  "method": "message/send",
  "id": 1,
  "params": {
    "message": {
      "parts": [
        {
          "kind": "text",
          "text": "Contact me at john.doe@example.com or call (555) 123-4567. My SSN is 123-45-6789."
        }
      ]
    }
  }
}
```

- Log

- Log and Mask

- Reject

When the action is set to **Log**, the policy logs detect PII with the actual values:

```json
[accessLog] Request: `Contact me at john.doe@example.com or call (555) 123-4567. My SSN is 123-45-6789.` has sensitive data: [
  {
    "pii_type": "Email",
    "value": "john.doe@example.com",
    "start": 14,
    "end": 34
  },
  {
    "pii_type": "Phone Number",
    "value": "(555) 123-4567",
    "start": 43,
    "end": 57
  },
  {
    "pii_type": "US SSN",
    "value": "123-45-6789",
    "start": 70,
    "end": 81
  }
]
```

When the action is set to **Log and mask**, the policy logs detect PII with masked values:

```json
[accessLog] Request: `Contact me at ****@example.com or call +1******567. My SSN is ***-**-*789.` has sensitive data: [
  {
    "pii_type": "Email",
    "masked_value": "****@example.com",
    "start": 14,
    "end": 34
  },
  {
    "pii_type": "Phone Number",
    "masked_value": "+1******567",
    "start": 43,
    "end": 57
  },
  {
    "pii_type": "US SSN",
    "masked_value": "***-**-*789",
    "start": 70,
    "end": 81
  }
]
```

When the action is set to **Reject**, the policy blocks the request and returns an HTTP 403 error
response. The upstream never receives the original request containing PII.

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "error": {
    "code": -32602,
    "message": "Invalid params",
    "data": "Request contains PII data: US SSN: 123-45-6789"
  }
}
```

### Custom Pattern Example

This example shows detection of a custom AWS Access Key pattern in a request:

```json
{
  "jsonrpc": "2.0",
  "method": "message/send",
  "id": 2,
  "params": {
    "message": {
      "parts": [
        {
          "kind": "text",
          "text": "Use this AWS key: AKIAIOSFODNN7EXAMPLE for deployment"
        }
      ]
    }
  }
}
```

With a custom pattern configured (`name: AWS Access Key`, `pattern: AKIA[0-9A-Z]{16}`), the policy
logs:

```json
[accessLog] Request: `Use this AWS key: AKIAIOSFODNN7EXAMPLE for deployment` has sensitive data: [
  {
    "pii_type": "AWS Access Key",
    "value": "AKIAIOSFODNN7EXAMPLE",
    "start": 18,
    "end": 38
  }
]
```

## Response Logging Example

When PII is detected in a response, the policy always logs it with raw values and forwards the
response unchanged:

Response from upstream:

```json
{
  "jsonrpc": "2.0",
  "id": 3,
  "result": {
    "task": {
      "description": "Process SSN 123-45-6789 for user john@example.com"
    }
  }
}
```

Log output (regardless of action configuration):

```json
[accessLog] Response: `Process SSN 123-45-6789 for user john@example.com` has sensitive data: [
  {
    "pii_type": "US SSN",
    "value": "123-45-6789",
    "start": 12,
    "end": 23
  },
  {
    "pii_type": "Email",
    "value": "john@example.com",
    "start": 33,
    "end": 49
  }
]
```

The response is forwarded to the client unchanged. The **Reject**, **Log**, and **Log and mask**
actions have no effect on response processing.

## Edge Cases

The policy passes through these without scanning:

- Non-POST requests

- Requests without a JSON Content-Type

- Bodies that don’t parse as JSON-RPC

- Methods not in scope (`SendMessage`, `SendStreamingMessage`, and other v1-style methods)

- Requests with missing or malformed `params`

- Empty text parts

- Parts with `kind` or `type` other than `"text"`

If a regex engine error occurs while scanning a single part, the error is logged and that part is
skipped, but remaining parts continue to be scanned.

## Compliance and Data Flow

These tables show where raw PII values appear based on the configured action.

### PII Detected in Request

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Action</th><th>Request Body on Wire</th><th>Access Log</th></tr></thead><tbody><tr><td><p>Reject</p></td><td><p>Blocked (HTTP 403 error; raw values appear in error.data string)</p></td><td><p>No log emitted on reject</p></td></tr><tr><td><p>Log and mask</p></td><td><p>Forwarded unchanged (raw PII flows upstream)</p></td><td><p>Masked</p></td></tr><tr><td><p>Log</p></td><td><p>Forwarded unchanged (raw PII flows upstream)</p></td><td><p>Raw</p></td></tr></tbody></table>

### PII Detected in Response

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Action</th><th>Response Body on Wire</th><th>Access Log</th></tr></thead><tbody><tr><td><p>Any (Reject, Log, Log and mask)</p></td><td><p>Pass-through (raw values flow to the client)</p></td><td><p>Raw</p></td></tr></tbody></table>

> [!IMPORTANT] For the A2A PII Detector policy, the **Log and mask** action only masks the access
> log, not the request body. Raw PII still flows to the upstream agent when using **Log** or **Log
> and mask** actions. Only **Reject** prevents PII from reaching the agent on the request side.

> [!IMPORTANT] Response-side detections are always logged with raw PII values and responses always
> pass through unchanged, regardless of the configured action. The policy never rejects or rewrites
> responses.

## See Also

- [MCP PII Detector Policy](https://docs.mulesoft.com/gateway/1.13/policies-included-mcp-pii-detector)

- [LLM PII Detection Policy](https://docs.mulesoft.com/gateway/1.13/policies-included-llm-pii-detection)