Information-flow labels on customer data
Mark fields containing PII at the type level. The compiler refuses to let a labelled value reach a public sink without an explicit Declassify boundary. Privacy by type, not by code review.
type Customer = {
email: string,
postcode: string,
signupDate: string
}
-- assigning customer.email to a log line is a type error.