Housing and public-health CI fixtures must exercise workflows without storing raw resident identifiers. Which practice supports that requirement?

Housing and public-health CI fixtures that must exercise workflows without storing raw resident identifiers should use tokenization, substituting tokens for raw PII values. Tokens preserve the referential shape needed for joins and workflow logic while keeping direct identifiers such as names, Social Security numbers, and addresses off runner disks, artifacts, and logs. Municipal privacy expectations and often legal constraints make production-like identity data inappropriate in CI; tokenized fixtures still let automation validate branching and field handling safely. Copying full production resident databases into every CI runner nightly fails because it spreads PII and increases the potential impact of a breach. Printing Social Security numbers into build logs fails confidentiality and creates durable exposure in logs. Disabling all tests that touch identity fields fails quality: critical paths go unverified instead of being tested with privacy-preserving fixtures. Exam caveat: tokenization is not the same as encrypting production data at rest; the focus here is CI fixture design, where stable surrogate IDs may be needed across test steps. Practical check: configure fixture generators to emit tokens instead of raw resident IDs, scan CI logs for PII patterns, prohibit production database clones in pipeline policy, and periodically verify that identity-touching housing and public-health tests still run against tokenized data rather than being skipped.