AI Language and Vision: secure triage pipelines (illustrative)

Problem

Support tickets, scanned forms and screenshots all contain personal data, and the people asking for automated triage rarely want to train a model. OCI Language and Vision offer pretrained models behind regional endpoints, which is a good fit when the goal is to route and summarize rather than to research.

The design question is where personal data goes. I wanted the masking to happen before anything gets stored or forwarded, and I wanted a trail showing which call touched which document.

Options and trade-offs

• Language service (entities, sentiment, key phrases, PII detection): good for text pipelines, as long as PII is masked before downstream storage.
• Vision (document and image analysis, text detection, object detection): good for PDFs and images, with batch jobs and custom models available.
• Inline versus asynchronous jobs: inline is simpler for a small payload, and batch jobs backed by Object Storage scale better.

My recommendation

Use inline calls for small, interactive requests and Object Storage backed jobs for volume. Run PII masking first in the text path. Store only the masked output, keep request identifiers for audit, and set a retention period before the first production run.

Worked example

Masking personal data in a piece of text with the Language service. This uses the PII entity detection call with a masking option, and it needs a Python environment with the OCI SDK configured for your tenancy.

import oci
 
config = oci.config.from_file()
language = oci.ai_language.AIServiceLanguageClient(config)
 
doc = oci.ai_language.models.TextDocument(
    key="ticket-1042", text=ticket_text, language_code="en")
 
resp = language.batch_detect_language_pii_entities(
    oci.ai_language.models.BatchDetectLanguagePiiEntitiesDetails(
        documents=[doc], masking={"ALL": {"mode": "MASK"}}))
 
masked = resp.data.documents[0].masked_text   # store this, not ticket_text

Analyzing a scanned document in Object Storage with Vision. The result is text you can pass to the masking step above.

vision = oci.ai_vision.AIServiceVisionClient(config)
 
result = vision.analyze_document(
    oci.ai_vision.models.AnalyzeDocumentDetails(
        compartment_id=compartment_ocid,
        document=oci.ai_vision.models.ObjectStorageDocumentDetails(
            source="OBJECT_STORAGE",
            namespace_name=namespace,
            bucket_name=input_bucket,
            object_name="scan-0007.pdf"),
        features=[oci.ai_vision.models.DocumentTextDetectionFeature(
            feature_type="TEXT_DETECTION")]))
 
print(result.headers.get("opc-request-id"))   # keep for the audit trail

For larger volumes, create a document job through the CLI or SDK with input and output locations in Object Storage, then poll for completion. Run the workload as an instance or resource principal and grant it only the Language, Vision and bucket access it needs.

Checklist

1. Mask or remove PII before storing any text.
2. Use inline calls for small payloads and batch jobs for volume.
3. Keep outputs only as long as you need them.
4. Record request IDs and compartment ownership for audit.
5. Check supported file formats and languages before choosing a feature.
6. Use instance or resource principals instead of keys in code.

Where this doesn't apply

Fully air-gapped environments cannot call these cloud endpoints. They need models that run locally instead.

One honest limitation

Bulk analysis produces a lot of metadata and intermediate output. Decide on redaction and retention rules up front, or the results bucket turns into its own data-protection problem.

Sources

• OCI Documentation: Language, Detecting Personally Identifiable Information
• OCI Documentation: Vision, Document AI Overview
• OCI Python SDK Reference: AIServiceLanguageClient and AIServiceVisionClient