> Source: https://wexa.ai/docs/governance/field-sensitivity

# Field sensitivity

Field sensitivity decides which people can see an individual field of a connector's data, such as a contact's email address or an invoice amount. Anyone who can manage a connector can set it, once the connector is set up and has synced its data. It is set in the console only.

1. In the console, open **Connect**, then **Connectors** (`/connect/connectors`).
2. Open the actions menu of the connector and choose **Field sensitivity**. The option is disabled for a connector that is not live, such as a simulated one.
3. Pick the entity type on the left, then pick a level for each field on the right. The dialog describes each level next to the choice.
4. Choose **Save**.

If the dialog says there is no project ontology yet, sync the connector first.

## Limits

| Behavior | What to expect |
| --- | --- |
| Internal | Masked for every role, super administrators included. |
| Unclassified field, name matches nothing | Visible to anyone who can read the connector's data. |
| Field sensitivity and data classification | Independent. Changing one does not change the other. |
| Connector not synced | No project ontology to edit, so no fields to classify. |

**How field sensitivity works, the levels and who holds each clearance**

## How it works

1. **Every field has a level.** It is Unclassified (auto), PII, Financial or Internal.
2. **A level maps to a clearance.** PII and Financial each need the matching clearance, and Internal needs none because no one holds it.
3. **Clearances come from roles.** Each role either carries the PII and Financial clearances or does not.
4. **A read checks both.** If the person's role lacks the clearance for a field's level, that field is masked.

## The levels

| Level | Who can see the field |
| --- | --- |
| **Unclassified (auto)** | Decided from the field's name. See [unclassified fields](#handle-unclassified-fields). |
| **PII** | People whose role has the PII clearance. |
| **Financial** | People whose role has the Financial clearance. |
| **Internal** | No one. The field is always masked, administrators included. |

Use **PII** for personal data, such as names, email addresses, phone numbers and home addresses. Use **Financial** for amounts, prices, salaries, account numbers and other money data. Use **Internal** for a field that should never be shown to anyone, whatever their role.

## Check who holds each clearance

By default, clearances follow the role:

| Role | PII | Financial |
| --- | --- | --- |
| Super administrator | Yes | Yes |
| Organization administrator | Yes | Yes |
| Compliance officer | Yes | Yes |
| Department administrator | Yes | No |
| Project administrator | Yes | No |
| Other members | No | No |

A role's clearances are part of its scopes and can be changed. See [roles and permissions](/docs/administration/members-and-roles). No role or clearance can see a field marked **Internal**.

An API key can also be narrowed to a subset of what its creator reads. See [Issue a key](/docs/administration/credentials#issue-a-key).

## Handle unclassified fields

A field left as **Unclassified (auto)** is classified from its name:

- Names that look like personal details, such as `email` or `phone`, are treated as PII.
- Names that look like money, such as `amount` or `price`, are treated as Financial.
- Record identifiers are treated as Internal.
- A name that matches none of these is visible to anyone who can read the connector's data.

Set a level explicitly when the name is misleading. A free-text `notes` field that holds personal details should be set to **PII** or **Internal**, because its name alone does not mark it as sensitive. Setting a field back to **Unclassified (auto)** returns it to classification by name.

**Field sensitivity versus data classification**

Connectors also have a **Data classification** (Public, Internal or Restricted). The two settings answer different questions:

- **Field sensitivity** decides which **people** can see a field.
- **Data classification** decides which **AI models** may process the connector's data. When a run uses data from several sources, Wexa applies the strictest classification among them when it chooses a model.

A connector classified as Restricted still shows its unclassified fields to people who can read it. Marking a field Internal hides it from people without changing which models may process the connector's data.

Related: [Connectors](/docs/connectors/overview) provisions and syncs the connector whose fields you classify, [roles and permissions](/docs/administration/members-and-roles) changes which roles hold the PII and Financial clearances, and [where your data goes](/docs/context/overview#where-your-data-goes) says which store a connector's synced data lands in.