The CSR shouldn't see the whole string but not all systems follow that approach.