Meridian's data science lead reviews the design for the safety-review summarizer and notes that incident narratives sometimes contain crew members' names and other personally identifiable details. At the design stage - before any pipeline is built - what should the engineer flag as a required design consideration, even though PII masking implementation itself belongs to governance?

At the design stage, the engineer should account for exactly where PII enters and exits the pipeline - whether raw narratives ever reach the model layer unmasked, or only a pre-masked version does - because this defines the attachment point governance controls will later need; a pipeline drawn without that consideration has no clear place to plug PII protection in later. Claiming PII is purely a governance concern with no design implication is wrong because the objectives explicitly separate 'apply masking' (governance) from 'design where masking must sit in the flow' (design) - the design decision of what data touches which component is what makes later governance enforcement possible at all. Designing the summarizer to actively extract and highlight names is the opposite of what's appropriate here - surfacing more PII more prominently increases exposure risk rather than reducing it, and is not what a safety-review summarizer needs to do its job. Assuming a model vendor automatically strips PII with no engineer involvement is an unsafe assumption to bake into a design; provider-side redaction, where it exists at all, should not be relied upon in place of an engineered PII path the team can verify. Recognizing that design decisions create (or foreclose) governance options later is a distinct associate-level skill from executing the masking itself.