Cat-19 ยท T833 ยท Agentic Commerce
v1.0

PAN and SAD Exposure Linter

Check a declared token-record schema against the published masking rule and the sensitive-authentication-data retention rules: how each declared field displays the primary account number, what the alias template and declared search-index expressions reveal, which sensitive authentication elements the declaration stores past authorization (encrypted or not), and whether digest fields cover the entire PAN and are keyed. The input is a declaration, never card data itself: the schema names fields, mask expressions, and storage facts, and no primary account number value is ever entered on this page.

Scope and reliance: ๐Ÿ”’ All inputs are processed locally in your browser. No data is transmitted. Do not enter real personal data โ€” use synthetic or anonymised inputs only. This page checks the declaration you type against the published rule text and asserts nothing about the system the declaration describes: business-need role lists, issuer carve-outs, deletion processes, key management, and display surfaces you do not declare are outside the input, and several carve-out conditions resolve to manual-review flags instead of a pass because the facts that decide them are yours, not the schema's. Cited text (PCI DSS v4.0.1) was retrieved November 2026; verify against the current official text and your own assessor before relying on any output, since this page is not legal, compliance, or assessment advice. Deterministic logic ยท no inference ยท zero PII ยท runs offline ยท CC BY 4.0.
Vendor-Neutral Schema Declaration Only Zero PII Client-Side
๐Ÿ”’ All inputs are processed locally in your browser. No data is transmitted. Do not enter real personal data โ€” use synthetic or anonymised inputs only.
Record declaration
A label for the record kind this schema describes, echoed in the report.
Where the declared record is described as living; echoed, never scanned.
The display template aliases of the PAN are declared to use; checked against the same ceiling.
Any display expression a declared search index renders; each line is checked against the same ceiling. A declared expression with no recognizable directive is reported for manual review rather than passed silently.
Schema fields (3 slots; a slot is used when its name is filled)
Field slot 1
Recognized mask directives: prefix:N, suffix:N, redact:N, redact:all, plain. An empty mask on a PAN field is a declared no-mask state and is reported as a full-display finding, not refused.
Field slot 2
The card verification code of a card-type record is declared here as a field of class card_verification_code: declaring one is only a schema statement, and its retention is judged from the stored-element slots below.
Field slot 3
Mask expressions are parsed strictly: any token outside the recognized grammar refuses the whole run rather than guessing what you meant.
Stored data elements (3 slots; retention, storage class, encryption)
Element slot 1
A persistent element holding sensitive authentication data past authorization is flagged whether or not you declare it encrypted.
Element slot 2
A non-persistent element holding sensitive data past authorization resolves to a manual-review flag: the carve-out conditions are facts about your operation, not your schema.
Element slot 3
Declaring a digest of a PAN fragment or an unkeyed whole-PAN digest is flagged against the hash requirements; no digest field is declared, no digest verdict is produced either way.