The config file

UnitAutogen finds PHI, personal data and audit tables on its own. When it misses one, or picks one wrongly, you correct it in one file, unitautogen.toml. Every compliance module reads it.

Where it lives

unitautogen.toml in the folder you run from, picked up automatically
Or any path, with --config path/to/file.toml
Every command accepts it
No file, no change to the run
TOML, the same format as Supabase's config.toml

Example

[phi]                       # HIPAA: protected health information
tables  = ["clinic.patients", "clinic.visits"]
columns = ["clinic.staff.home_phone"]
not     = ["public.countries", "clinic.users.email"]

[pii]                       # personal data (PII-in-error check)
columns = ["crm.contacts.mobile_no"]

[audit]                     # audit tables
tables  = ["audit.change_log"]
not     = ["clinic.event_types"]

[audit.map]                 # optional: where a table's changes must be logged
"clinic.patients" = "audit.patient_log"
"clinic.visits"   = ["audit.change_log", "audit.visit_history"]

Sections

Section	What it declares	Used by
`[phi]`	Tables and columns that hold PHI	HIPAA report, PII audit
`[pii]`	Tables and columns that hold personal data	PII audit
`[audit]`	Audit tables	HIPAA audit controls and integrity
`[audit.map]`	Which audit table each table must log to	HIPAA audit controls

tables adds tables the tool missed
columns adds columns the tool missed
not removes a wrong guess
PHI counts as personal data, so [phi] also feeds the PII audit

Names

A table is schema.table
A column is schema.table.column
Leave the schema out to match in every schema of the run
Case does not matter, as with unquoted names in PostgreSQL
Quote a mixed-case name as in SQL, 'clinic."CustomerPII".email'

Rules

The file always wins over detection
A column entry beats a table entry
A column of a declared table belongs to that table's class
The same name added and removed in one section is an error

What each entry changes

[audit] tables makes a table an audit table, whatever its name
[audit] not judges a log-like table as a data table
[audit.map] is checked on every run. A change logged to a different audit table is a gap
[phi] tables marks a data table as holding PHI, even when its name looks like a log
[phi] not keeps the table in the HIPAA report, with its findings marked
columns entries classify a leaked value as PHI or personal data, whatever the column's name

What came from the file

The report always shows which tables and columns came from the config file, not from detection.

A "Taken from the config file" table in the HIPAA and security coverage reports, with the line in the file
"from config file" next to every declared table, audit table and finding
The file's path and SHA-256 in the evidence stamp

Checks

A bad file stops the run with exit code 2 and names the line
A name not found in the database is a warning, never ignored
The run prints which file it used