How reversibility works

TokenVeil replaces each detected value with a typed placeholder and can put the real value back later. This page explains how that stays reliable across long, multi-step sessions, which matters for agentic tools where placeholders travel through many turns.

Typed, stable tokens

A detected value is replaced with a placeholder of a fixed shape, carrying its type and a number, for example <PERSON_1> or <IBAN_CODE_1>. Within one session the mapping is stable: the same real value always maps to the same token, so text stays coherent across turns. The mapping between tokens and real values is stored encrypted on your instance and is addressable only through the session id, an opaque high-entropy capability token that is not enumerable.

Restoration is global, not positional

De-anonymization does not depend on where a token sits. It resolves every token of the fixed shape against the session mapping, wherever it appears. This is what makes it hold up in agent sessions:

• if the model moves a placeholder around in its reply, it still resolves,
• if it embeds a placeholder in code or JSON, it still resolves,
• if it repeats the same placeholder across several tool calls, each occurrence resolves to the same real value.

Because restoration is a global resolution against a stateful mapping rather than a positional replay, multi-step sessions do not drift.

The edge case: mutated tokens

The one case to be honest about is a model that mutates a token rather than reusing it verbatim: splitting it, renaming it, changing its case, or inventing a variant. Common mutations such as case differences are handled. A token the model has genuinely rewritten or hallucinated is the residual edge case, and it is exactly the kind of behavior a pilot on your real agent traffic is meant to stress-test.

Scope of a pseudonym

Today the mapping is scoped to a session: the same value is stable within one session and receives a different token in another session. A configurable scope key, for example a stable token within one workspace or case and a different one elsewhere, is a defined extension rather than a rework.