How it works: register a (connection, column name) pair below. Whenever a Claude tool call runs a SELECT against that connection and the result has a column matching the name, the column (and its data) is removed before the response is handed to the model. Matching is by exact column name, so ssn hides every ssn column on that connection regardless of which table it came from.