Stop agents leaking personal data and secrets to model providers
Detect sensitive data in requests and responses. Mask or tokenise supported text, with the detector limits set out below. The head of IT who signed off the agent that reads customer tickets A card number or a live API key goes out inside a prompt. The question is not what it cost but who can say it will not happen again, and the answer is that a regular expression ran somewhere in a codebase.
A regular expression inside the agent is not a control.
The first attempt fails structurally rather than technically: it is enforced by the thing being governed, it changes whenever somebody redeploys, and it exists in one of your seven agents because one team wrote it. Pointing your existing data-loss tooling at egress traffic leaves the response leg, which is where a credential comes back out.
4 steps, in this order.
Route both legs through one endpoint
Change the base URL and credential on each agent. Until then a rule polices whichever half somebody remembered.
Stage the rule in shadow
It is evaluated exactly as an enforcing rule and then skipped, so you learn the false-positive rate before it stops anyone's work.
Choose mask or tokenise
Mask when the model has no use for the entity, tokenise when it must keep customers distinct. Credentials are always masked.
Cover the way back
Rules run again on the response leg: after the full response when buffered, before the first byte on a stream.
Review the detectors and their limits before promoting a rule.
See the detectors and their confidenceBuilt for
- Agents you can point at a new base URL, so both legs reach one enforcement point.
- Identifiers with a shape: cards, IBANs, NHS and NI numbers, emails, phones, four credential kinds.
- A team that needs the record too: direction, mode, kinds and counts, values never stored.
Wrong for
- Anyone who needs free-text personal data caught. This is a compensating control, not a complete data-loss prevention layer.
- Anyone whose identifiers fall outside the shipped UK and US formats. Adding one is a code change rather than a setting.
- Anyone expecting it to govern what their own application does with the returned text.
One thing on the record
Two super-linear regular expressions were found in Token Observe's own injection scanner and are published in its defect list: the one reported, and a worse one found by auditing the rest.
Both were rewritten to be linear and a 65,536-character cap added. The figures and their conditions travel together on the policy-engine page.
Where this is publishedEleven kinds, and the confidence that comes with each.
Detection is regular expressions plus checksums over text that has already been normalised, and normalising first is the whole of one attack. The Unicode tag block at U+E0000 to U+E007F encodes an invisible ASCII alphabet: legible to the model, invisible to a reviewer. The scan caps at 65,536 characters, so a value hidden past that is not detected.
- Checksum-validated
- credit_card by Luhn, iban by mod-97, uk_nhs_number by mod-11. A shape failing its checksum is not reported at all.
- Pattern-only personal data
- us_ssn, uk_nino, email and phone. Lower confidence by design, so a policy sets its own threshold.
- Secret kinds
- jwt, aws_access_key, api_key and private_key. Prefixed vendor shapes are enumerated rather than caught by entropy.
- Not detected
- Names, addresses, free-text descriptions, and any identifier outside the shipped UK and US shapes.
- Workspace configuration, registry, policies and decisions
- Billing evidence from the connections and imports you supply
- Supplied connection credentials, encrypted at rest
- Request metadata for traffic routed through the workspace
- Bounded, redacted prompt and reply text when capture is enabled
- Billing queries using the reporting permissions you supply
- Routed model payloads after the applicable policy checks
- Model-assisted search using a separately configured inference key
- Authorized evidence reads and CSV exports to your client
The cloud service processes and stores workspace evidence and supplied credentials. Supabase handles account authentication; Railway runs the cloud pilot. Cloud hosting does not keep all data inside your network.
Billing cannot recover historical conversations. Activity covers routed traffic or supported evidence supplied to the workspace. Text capture is off by default, and redaction is heuristic.
Customer hosting is an optional, separate deployment choice. Its infrastructure and data boundary differ from the cloud pilot.
Two rewrites are refused.
A sensitive value in a JSON object key is refused, because renaming a key changes which argument the tool receives. Text found by OCR inside an image is refused, because a text redactor cannot reach pixels. The redaction event carries direction, mode, kinds and counts, and never the matched value, since recording it would move the leak into the flight recorder.
4 things this still does not solve.
- Free-text personal data is not detected. A name, an address or an account narrative in prose matches no pattern, and neither does any identifier outside the shipped set.
- What your application does with the returned text is outside the boundary. The moment your code renders it into HTML, no gateway control reaches it.
- An agent that calls a provider directly is not redacted at all. Nothing inspects a payload that never arrives, which makes coverage a discovery question first.
- Switching capture to redacted puts a second copy of the prompt and reply in your own evidence store, and cloud activity retention is configured to 30 days; customer-hosted trace retention is unset by default, which means keep forever.
Check the product limits alongside the job you want to do.
What we do not claimThe parts that do the work.
Policy engine
One deterministic verdict on every governed request: allow, block, redact, or park it for a human.
Injection scoring is nine fixed patterns, not a model
Flight recorder
Every governed request in a timeline a compliance officer can read, and a search box that never writes SQL.
The filter cannot group, count or correlate across traces
MCP gateway
The half of an agent that moves money is a tool call, not a sentence. This is the checkpoint that call goes through.
A tool call routed around it is not governed here
Questions
Which personal data classes does Token Observe detect?
Eleven kinds: credit card by Luhn, IBAN by mod-97, NHS number by mod-11, plus US social security numbers, UK national insurance numbers, emails and phone numbers by pattern, and four credential shapes: JSON web tokens, AWS access keys, prefixed vendor API keys and PEM private-key headers. Free-text personal data is not detected.
What is the difference between masking and tokenising?
Masking replaces the value with an irreversible marker naming the kind it was. Tokenising replaces it with a placeholder stable for that value across one governed call, so a model can treat two customers as distinct without receiving either. Credentials are always masked irreversibly.
Is this enough to satisfy a data protection officer?
It is a compensating control and should be described as one: an enforcement point outside the agent, a record of kinds and counts with the values never stored, and a refusal rather than a silent rewrite. It is not complete coverage of personal data. State the detected set, state the gap beside it, and set a retention window deliberately.
Describe the version of this you have.
Say what your estate contains and which part of it worries you, and the reply will say where to start.