Content-Addressed Redaction with Local Restoration: Secret Handling for Tool-Using AI Agents

Abstract

Tool-using AI agents run on a user's machine but delegate cognition to a third-party model provider. Whenever a credential, phone number, or access token has to appear in a prompt so that the agent can act on it, the usual choices are to expose the secret to the provider or to prevent the agent from acting at all. We describe and evaluate a third option, implemented in the open-source agent runtime BrainTentacle: *content-addressed redaction with local restoration*. Before a request leaves the machine, every occurrence of a registered sensitive value, and every occurrence matched by an enabled regular expression, is replaced in the copy of the conversation that will be transmitted by a placeholder whose text is a prefix of the SHA-256 digest of the replaced value. When the model returns tool arguments, the dispatcher substitutes the real values back before execution, so the agent acts on a secret it never saw. Because the placeholder derives from the value's content rather than from an enumeration counter, the same secret carries the same token across turns and independently of registration order; this is what makes the token quotable by the model in a later turn. We contribute (i) a precise description of the mechanism against the artifact, (ii) a measurement harness that links the shipping implementation as a library and measures detector precision and recall on a 62-document corpus of realistic and adversarial payloads, round-trip fidelity, placeholder stability, and the collision behaviour of truncated digests, and (iii) an enforcement audit that identifies three concrete gaps in the current implementation, including a request path on which redaction is not applied at all. We report only measured quantities, and we state the limitations explicitly: the secondary audit layer is experimental and fails open by design, and the workspace path jail is lexical with no default root.

Body

Imported entry paper (unverified hypothesis)

This paper was imported into jetessays as an entry paper from the author's local archive (hiddencode). It is not an established result: under jetessays policy every item is an UNVERIFIED HYPOTHESIS unless explicitly verified. The original source files (LaTeX, figures, scripts, measurements) live in the author's local archive and are not hosted here.

Abstract (as submitted)

Tool-using AI agents run on a user's machine but delegate cognition to a third-party model provider. Whenever a credential, phone number, or access token has to appear in a prompt so that the agent can act on it, the usual choices are to expose the secret to the provider or to prevent the agent from acting at all. We describe and evaluate a third option, implemented in the open-source agent runtime BrainTentacle: content-addressed redaction with local restoration. Before a request leaves the machine, every occurrence of a registered sensitive value, and every occurrence matched by an enabled regular expression, is replaced in the copy of the conversation that will be transmitted by a placeholder whose text is a prefix of the SHA-256 digest of the replaced value. When the model returns tool arguments, the dispatcher substitutes the real values back before execution, so the agent acts on a secret it never saw. Because the placeholder derives from the value's content rather than from an enumeration counter, the same secret carries the same token across turns and independently of registration order; this is what makes the token quotable by the model in a later turn. We contribute (i) a precise description of the mechanism against the artifact, (ii) a measurement harness that links the shipping implementation as a library and measures detector precision and recall on a 62-document corpus of realistic and adversarial payloads, round-trip fidelity, placeholder stability, and the collision behaviour of truncated digests, and (iii) an enforcement audit that identifies three concrete gaps in the current implementation, including a request path on which redaction is not applied at all. We report only measured quantities, and we state the limitations explicitly: the secondary audit layer is experimental and fails open by design, and the workspace path jail is lexical with no default root.

Note

Imported via the jetessays seed importer. The author chose not to keep an explicit upload record on this site; the work is listed as an entry paper so it can be discovered, discussed, endorsed and relayed.

Discussion

Log in to join the discussion

← back to browse