Engineering note
Keeping the mapping stable across a document — and a stream.
Deterministic pseudonymization is easy to state and harder to keep honest under load. This note is a work in progress; the short version is below, with more to come.
The property
The same real value must always map to the same realistic stand-in within a request — and map back, locally, when the response returns. A key seen twice should not become two different keys, or the model loses the thread.
Why a lookup table isn't enough
A single document can mention the same value in different shapes — a path, then its basename; a full email, then just the local part. The mapping has to recognize those as the same entity, stay consistent as text streams back token by token, and remain reversible without ever writing the real values off the device.