The demo shows how to configure tokenization and masking of sensitive data using HCP Vault's transform secrets engine, which can be used with IBM Granite, Ollama, and Open WebUI for RAG. The goal is to protect access to sensitive information like credit card numbers and billing street addresses while still allowing the LLM to analyze and provide other information without leaking payment details. By using masking or tokenization transformations, you can ensure that only authorized applications have access to reveal sensitive data. The demo also highlights the importance of implementing AI agents to decode the payload with Vault's transform secrets engine for applications that need access to full plaintext credit card numbers or billing street addresses.