“Just Don’t Put PII in the Prompt” Is a Trap: A Two-Plane Architecture for Safe LLM Apps

Why “Just Don’t Put PII in the Prompt” Doesn’t Work

Mobile teams typically start with good intentions: redact emails, don’t log raw text, and avoid sending sensitive fields to an LLM provider. Then reality hits:

• Debug logs capture prompts “temporarily” (and become permanent).


• RAG pulls in internal documents that contain secrets.


• Tool calling expands scope: the model can “ask” for more data.


• Engineers add “one more field” to improve answers.


• A prompt injection attempt convinces the model to request sensitive content.

The core problem is that the prompt becomes a dumping ground for whatever might help the model. Once you do that, you’ve lost control of data boundaries.