OpenAPI Overlays for Compliance and Redaction Profiles

Somewhere in every regulated company there is a document, or a wiki page, or a Slack message pinned to a channel, that says something like “before we publish the EU version of the API, remember to take out the SSN field and turn off the cancellation endpoint.” It is a checklist. A human reads it, or forgets to read it, and then edits the spec by hand until it looks compliant. When the auditor shows up and asks how you know the personally identifiable data never left the jurisdiction, the honest answer is: we trust that Dave ran the checklist.