Presidio

Agentic OS installs observe email, documents, and tool I/O. Before those strings hit an LLM, a log sink, or a shared corpus, PII must be detected and transformed under policy. Presidio is the mature open baseline for that job: analyzer → operators (replace, mask, encrypt, hash, keep, surrogates) → optional deanonymize. It sits on the observe / gate path with LLM Guard-style scanners and GLiNER as a stronger zero-shot NER backend — not as the ledger or authority layer.

Text enters the AnalyzerEngine, which runs registered recognizers (built-in entity types plus custom ones) and returns scored spans with entity types and offsets. The AnonymizerEngine applies per-type operators (replace, mask, encrypt, hash, custom lambda, AHDS surrogate, keep). Image redaction OCRs pixels then reuses text analysis; structured mode walks tables/columns. Deploy as pip libraries, Docker HTTP services, Spark/Fabric notebooks, or Kubernetes samples.

1. pip install presidio-analyzer presidio-anonymizer (and a spaCy model).
2. AnalyzerEngine.analyze(text, language=…) → RecognizerResult list.
3. AnonymizerEngine.anonymize(text, analyzer_results, operators=…).
4. Optionally deanonymize encrypted spans with the matching key.

Related: gliner · llm-guard · guardrails-ai · nemo-guardrails · topics/13-governance-policy

• Use when: you need a self-hosted, customizable PII pipeline (recognizers + operators) for text/images/tables before LLM/RAG/log sinks.
• Skip when: you only need zero-shot open NER without an anonymizer stack (gliner alone), or a commercial DLP SaaS with managed accuracy SLAs.
• Prefer instead: pair Presidio pattern recognizers with gliner / nvidia/gliner-PII for names and open types; use guardrails-ai / nemo-guardrails when the gate is broader than PII.

• No completeness guarantee — project warning: automated detection will miss entities; stack additional controls.
• Not an official Microsoft product — MIT OSS; Azure Language / AHDS are separate commercial services.
• Accuracy vs SaaS — FAQ: managed PII APIs often beat default Presidio coverage; Presidio wins on customizability.
• Hash salt — recent breaking change: hash operator uses random salt by default (referential integrity needs explicit salt).
• Not the ledger / not HITL — redaction ≠ approval authority.