@@ -187,12 +187,31 @@ export interface OPAGuardrailConfig {
   mode?: "audit" | "enforce" | "fail_open" | "fail_closed";
   timeout_seconds?: number;
 }
+/** PII action per entity type (SRS RAI `pii_detection`). */
+export type PIIAction = "redact" | "block" | "disabled";
+
+/** Custom keyword/regex PII rule. */
+export interface CustomPII {
+  label: string;
+  replacement: string;
+  action: PIIAction;
+}
+
+/** SRS RAI PII guardrail config — drives gateway-level redaction. */
+export interface PIIDetectionConfig {
+  enabled: boolean;
+  /** Entity type → action (e.g. `{ EMAIL_ADDRESS: "redact", US_SSN: "block" }`). */
+  types: Record<string, PIIAction>;
+  custom_pii?: CustomPII[];
+}
+
 export interface PolicyDoc {
   _id: string;
   name: string;
   description: string;
   cedar_guardrail?: CedarGuardrailConfig | null;
   opa_guardrail?: OPAGuardrailConfig | null;
+  pii_detection?: PIIDetectionConfig | null;
   created_at?: string;
   updated_at?: string;
   [k: string]: unknown;
 
@@ -1,5 +1,5 @@
 import { useEffect, useState } from "react";
-import { api, type PolicyDoc, type CedarPolicyEntry, type OPAPolicyDoc } from "../api.ts";
+import { api, type PolicyDoc, type CedarPolicyEntry, type OPAPolicyDoc, type PIIAction } from "../api.ts";
 import { useAuth } from "../context/AuthContext.tsx";
 
 /**
@@ -128,8 +128,29 @@ interface EditorState {
   opaHook: "llm_input" | "llm_output" | "tool_input";   // stage the OPA binding runs at
   opaMode: "audit" | "enforce" | "fail_open" | "fail_closed";
   opaTimeoutSeconds: number;
+  // PII guardrail — drives gateway-level redaction (SRS RAI pii_detection).
+  piiEnabled: boolean;
+  piiActions: Record<string, PIIAction>;   // entity type → redact | block | disabled
 }
 
+// Curated subset of SRS PIIEntityType (Presidio) — the common ones surfaced in
+// the UI. The full set is accepted by SRS; advanced entities can be managed via
+// the API. Each maps to an action: Off (disabled) | Redact | Block.
+const PII_ENTITIES: ReadonlyArray<{ key: string; label: string }> = [
+  { key: "EMAIL_ADDRESS", label: "Email address" },
+  { key: "PHONE_NUMBER", label: "Phone number" },
+  { key: "PERSON", label: "Person name" },
+  { key: "CREDIT_CARD", label: "Credit card" },
+  { key: "US_SSN", label: "US SSN" },
+  { key: "IBAN_CODE", label: "IBAN" },
+  { key: "US_BANK_NUMBER", label: "US bank number" },
+  { key: "IP_ADDRESS", label: "IP address" },
+  { key: "LOCATION", label: "Location" },
+  { key: "CRYPTO", label: "Crypto wallet" },
+  { key: "URL", label: "URL" },
+  { key: "DATE_TIME", label: "Date / time" },
+];
+
 const FRESH_CEDAR_RULE = (): CedarPolicyEntry => ({
   id: `rule_${Math.random().toString(36).slice(2, 8)}`,
   name: "Rule",
@@ -168,6 +189,13 @@ function PolicyEditor({
       "tool_input",
     opaMode: initial?.opa_guardrail?.mode ?? "audit",
     opaTimeoutSeconds: initial?.opa_guardrail?.timeout_seconds ?? 5.0,
+    piiEnabled: initial?.pii_detection?.enabled ?? false,
+    piiActions: Object.fromEntries(
+      PII_ENTITIES.map((e) => {
+        const a = initial?.pii_detection?.types?.[e.key];
+        return [e.key, a === "redact" || a === "block" ? a : "disabled"];
+      }),
+    ),
   }));
   const [saving, setSaving] = useState(false);
   const [err, setErr] = useState<string | null>(null);
@@ -207,6 +235,15 @@ function PolicyEditor({
         mode: s.opaMode,
         timeout_seconds: s.opaTimeoutSeconds,
       },
+      pii_detection: {
+        enabled: s.piiEnabled,
+        // Only persist entities with an active action; "disabled" ones are dropped.
+        types: Object.fromEntries(
+          Object.entries(s.piiActions).filter(([, a]) => a !== "disabled"),
+        ) as Record<string, PIIAction>,
+        // Preserve any custom rules created via the API (not yet editable here).
+        custom_pii: initial?.pii_detection?.custom_pii ?? [],
+      },
     };
     try {
       if (initial) await api.updatePolicy(initial._id, body);
@@ -372,6 +409,38 @@ function PolicyEditor({
         </Field>
       </Section>
 
+      <Section
+        title="PII redaction"
+        right={<Toggle checked={s.piiEnabled} onChange={(v) => upd("piiEnabled", v)} />}
+      >
+        <p className="text-[11px] text-gray-500 -mt-1">
+          When enabled, the LLM gateway scrubs these entities from prompts before they
+          reach the model (and restores them in the response). <span className="text-gray-400">Redact</span> masks
+          the value; <span className="text-gray-400">Block</span> refuses the request.
+        </p>
+        {s.piiEnabled && (
+          <div className="grid grid-cols-2 gap-x-6 gap-y-2">
+            {PII_ENTITIES.map((e) => (
+              <div key={e.key} className="flex items-center justify-between gap-2">
+                <span className="text-sm">{e.label}</span>
+                <select
+                  value={s.piiActions[e.key] ?? "disabled"}
+                  onChange={(ev) =>
+                    upd("piiActions", { ...s.piiActions, [e.key]: ev.target.value as PIIAction })
+                  }
+                  disabled={!canWrite}
+                  className="bg-ink-700 border border-ink-600 rounded px-2 py-1 text-sm w-28"
+                >
+                  <option value="disabled">Off</option>
+                  <option value="redact">Redact</option>
+                  <option value="block">Block</option>
+                </select>
+              </div>
+            ))}
+          </div>
+        )}
+      </Section>
+
       <div className="mt-6 flex items-center gap-2">
         {canWrite && (
           <button
 
@@ -977,6 +977,7 @@ export class ComputerAgentServer {
         const fromHost = process.env.ANTHROPIC_API_KEY;
         if (fromHost) envs.ANTHROPIC_API_KEY = fromHost;
       }
+      applyRedactionBaseUrl(envs, body.policy);
 
       const agent = new ComputerAgent({
         source,
@@ -1357,6 +1358,7 @@ export class ComputerAgentServer {
         const fromHost = process.env.ANTHROPIC_API_KEY;
         if (fromHost) envs.ANTHROPIC_API_KEY = fromHost;
       }
+      applyRedactionBaseUrl(envs, body.policy);
 
       const source = applyGitToken(normalizeSource(body.source), body.gitToken);
       // Build the agent but DO NOT call chat() yet — that's the substrate boot
@@ -2064,6 +2066,7 @@ export class ComputerAgentServer {
       const fromHost = process.env.ANTHROPIC_API_KEY;
       if (fromHost) envs.ANTHROPIC_API_KEY = fromHost;
     }
+    applyRedactionBaseUrl(envs, body.policy);
 
     const agent = new ComputerAgent({
       source,
@@ -2202,6 +2205,30 @@ export class ComputerAgentServer {
 
 // ── helpers ──────────────────────────────────────────────────────────────
 
+/**
+ * Route a run's LLM traffic through the in-process redaction gateway when the
+ * agent has a bound policy. Same spirit as the policy decider's server-side
+ * fallback: the policy id is the one CAS already holds (`body.policy.policyId`),
+ * and the SRS creds the gateway uses fall back to this server's own
+ * `SRS_BASE_URL`/`SRS_API_KEY`. We hand the id to the gateway by pinning
+ * `ANTHROPIC_BASE_URL` to `…/rai/<policyId>` (the proxy reads it off the path).
+ *
+ * No-op unless: the proxy is enabled, SRS is configured, a policy id is present,
+ * and the caller hasn't already set its own ANTHROPIC_BASE_URL.
+ */
+function applyRedactionBaseUrl(
+  envs: Record<string, string>,
+  policy?: { policyId?: string } | null,
+): void {
+  if (envs.ANTHROPIC_BASE_URL) return; // caller's explicit base wins
+  if (process.env.LYZR_PROXY_ENABLED === "0") return; // gateway opted out
+  if (!process.env.SRS_BASE_URL || !process.env.SRS_API_KEY) return; // redaction not configured
+  const policyId = policy?.policyId;
+  if (!policyId) return; // no bound policy → no redaction
+  const port = Number(process.env.LYZR_PROXY_PORT) || 8788;
+  envs.ANTHROPIC_BASE_URL = `http://127.0.0.1:${port}/rai/${encodeURIComponent(policyId)}`;
+}
+
 function normalizeSource(source: IdentitySource | string): IdentitySource {
   if (typeof source !== "string") return source;
   // Heuristic: anything with github.com/owner/repo or ending in .git is a git source.
@@ -2499,24 +2526,39 @@ if (import.meta.url === `file://${process.argv[1]}`) {
     bootDeadlineMs: intEnv("SANDBOX_BOOT_DEADLINE_MS", 60_000),
   };
 
-  // Optional: in-process Anthropic ↔ OpenAI translator proxy. When
-  // LYZR_PROXY_ENABLED=1 we boot @computeragent/llm-proxy-openai on
-  // 127.0.0.1:<port> so claude-agent-sdk / deepagents can target Lyzr (or
-  // any OpenAI-Chat-Completions backend) by setting `envs.ANTHROPIC_BASE_URL`
-  // = "http://127.0.0.1:<port>" on a /run or sandbox chat. Substrates
-  // running on the same host can reach the proxy via loopback (bwrap and
-  // local share the host's network namespace; e2b cannot — it would need
-  // a publicly routable proxy URL, out of scope here).
+  // In-process Anthropic ↔ OpenAI translator proxy + SRS PII redaction gateway.
+  // Enabled BY DEFAULT — set LYZR_PROXY_ENABLED=0 to opt out. Boots
+  // @computeragent/llm-proxy-openai on 127.0.0.1:<port>; policy-bound runs are
+  // routed through it (ANTHROPIC_BASE_URL=.../rai/<policyId>) so their prompts
+  // are redacted. Substrates on the same host reach it via loopback (bwrap and
+  // local share the host's network namespace; e2b cannot — it would need a
+  // publicly routable proxy URL, out of scope here). Still requires
+  // LYZR_UPSTREAM_TOKEN to actually start (skipped with a warning otherwise).
   //
   // gitagent doesn't need this proxy at all — gitclaw natively speaks OpenAI
   // Chat Completions via GITCLAW_MODEL_BASE_URL + provider:model@baseUrl.
   let lyzrProxyHandle: { port: number; close: () => Promise<void> } | null = null;
-  if (process.env.LYZR_PROXY_ENABLED === "1") {
+  if (process.env.LYZR_PROXY_ENABLED !== "0") {
     const { startProxy } = await import("@computeragent/llm-proxy-openai");
     const proxyToken = process.env.LYZR_UPSTREAM_TOKEN;
     if (!proxyToken) {
-      console.error("[lyzr-proxy] LYZR_PROXY_ENABLED=1 but LYZR_UPSTREAM_TOKEN is not set — skipping");
+      console.error("[lyzr-proxy] gateway enabled but LYZR_UPSTREAM_TOKEN is not set — skipping (set LYZR_PROXY_ENABLED=0 to silence)");
     } else {
+      // SRS-backed PII redaction at the gateway. Enabled when SRS creds are
+      // present; the RAI policy id is supplied per request via the URL path
+      // (`ANTHROPIC_BASE_URL=.../rai/<policyId>`), so any agent's bound policy
+      // drives its own redaction — nothing is hard-coded here.
+      const srsBase = process.env.SRS_BASE_URL;
+      const srsKey = process.env.SRS_API_KEY;
+      const redaction =
+        srsBase && srsKey
+          ? {
+              srsBase,
+              srsKey,
+              failOpen: process.env.LYZR_PROXY_REDACT_FAIL_OPEN !== "0",
+            }
+          : undefined;
+      if (redaction) console.error("[lyzr-proxy] SRS RAI PII redaction enabled");
       lyzrProxyHandle = await startProxy({
         port: intEnv("LYZR_PROXY_PORT", 8788),
         upstream: {
@@ -2525,6 +2567,7 @@ if (import.meta.url === `file://${process.argv[1]}`) {
           token: proxyToken,
           ...(process.env.LYZR_UPSTREAM_MODEL ? { modelOverride: process.env.LYZR_UPSTREAM_MODEL } : {}),
         },
+        ...(redaction ? { redaction } : {}),
       });
     }
   }
 
@@ -39,4 +39,4 @@
  * through their tool surfaces.
  */
 export { startProxy } from "./proxy.js";
-export type { ProxyOptions, ProxyHandle, UpstreamConfig } from "./proxy.js";
+export type { ProxyOptions, ProxyHandle, UpstreamConfig, RedactionConfig } from "./proxy.js";