Tag displayName as identification-username PII and declare daily purge with 30-day post-deletion hard-delete retention. PAYLOAD_AUTH_PII_DEFAULTS covers email/credentials automatically — no authPii override needed. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>