The Architecture That Holds

The honest answer about 100%

There is exactly one guarantee in this book that is absolute, and it is narrow:

A value that is structurally incapable of entering the payload cannot reach the model.

Not "unlikely to." Cannot. If your projection record has four fields and none of them is the customer's Social Security number, then no detector threshold, no container restart, no model upgrade and no clever prompt can cause that number to reach the provider from that code path. The guarantee comes from the shape of the code, not from the accuracy of a classifier.

Everything else in this book is probability.

So the architecture is not a machine that makes personal data safe. It is a machine that moves as much of your data as possible into the category where the guarantee is structural, handles the next category deterministically, and leaves you with a small, named, measured residue that you manage rather than eliminate.

That reframing is the whole chapter. Once you stop asking "how do I catch all the PII" and start asking "how much of this can I make structurally impossible to send," the problem becomes tractable, and you can say something precise about what is left.

The three tiers

Every field, every value, every payload in your system falls into one of three tiers. The architecture's job is to push things upward.

Tier 1 is the only place a guarantee lives. Chapter 12 is entirely about getting fields into it, and it is the cheapest work in the book.

Tier 2 is deterministic but bounded. A Luhn-validated card number will be caught every time it appears in a well-formed state. That is a real guarantee, and its boundary is exact: if the value is malformed, obfuscated, split across lines, or spelled out in words, the validator does not fire. The guarantee is "this class of well-formed identifier, always," not "all payment data, always."

Tier 3 has no guarantee and never will. A customer writing "my wife Karen has the same condition as her mother" in a support ticket has disclosed health data about two identified people, in prose, with no pattern. There is no detector configuration that reliably catches every instance of that, and Chapter 4 is the evidence. This tier is managed by making the blast radius small, not by making the detection good.

Everything below is in service of that table.