Bowden-PII / Guide 3 of 3 / 2 min read

Beneath the bonnet: rules and learned detection

Bowden combines a deterministic core with ongoing work on a small trained detection model.

The reason

A useful request does not always need a real name.

Applications often send identifying details alongside the context a model actually needs. Reducing that exposure should happen before the request leaves the system.

Bowden detects supported identifiers and replaces them with consistent placeholders. The mapping stays separate. This reduces exposure, but context can still identify someone, so evaluation remains necessary.

48Nauts / Product guides

The deterministic core

Pattern recognition and validators can identify structured values, including supported formats with checksum checks. The runtime exposes a Python API, CLI, policy presets and audit metadata without raw values.

These checks have explicit coverage boundaries. A recognised format is not the same thing as complete detection of every kind of personal data.

The trained model

Bowden also has its own fine-tuned small token-classification model. This is a learned detector, rather than only a lookup list of known values.

The neural runtime remains experimental. The deterministic website examples should not be read as results from the trained model. Evaluate the selected runtime and policy against the intended domain.

The application owns the boundary

Local execution keeps this processing step in your environment, but storage, tenant separation and access to original values remain application responsibilities.

Test the full journey, including logs and error handling. A mapping that stays local can still be exposed if another component writes original values into an uncontrolled log.