Stop secrets and restricted data reaching an unapproved model

The challenge

Coding agents send source code and context to model providers on their own, and a team cannot show which data went where or under which rule.

The scenario

A platform team lets developers use an agent runner they operate. A developer's task would send a file containing an API key, from a repository classified as restricted, to a model provider that is not on the EU profile's approved list.

What goes in

Approved policy bundle

The rules for model providers, repositories and secrets, approved by a second person.

Sovereignty profile

Which providers, endpoints and regions each data classification may reach.

What you can ask

Illustrative prompts. Results depend on your own data and are not deterministic.

• “Can this agent send this repository's code to this model provider?”Copy
• “Why was the agent's last tool call denied?”Copy

How Clearception approaches it

How the work is structured. Each step shows what its output is grounded in.

1. 1

   The agent asks first

   Observed

   Before the tool call runs, the runner's guard sends the action, resource and context to the gateway.

2. 2

   Secrets are detected

   Observed

   Credential detection runs on the request before any policy is evaluated.

3. 3

   Policy and sovereignty decide

   Observed

   The rules and the profile return deny, with the reason code and the rule that matched.

4. 4

   Evidence is written

   Source

   The decision is appended to the organization's hash chain; if that fails, the answer is deny.

What you get

The shape of what comes back — not a promised result.

• Decision with its reason

  Observed

  Deny, the reason code and the matching rule, returned to the agent before it acts.

• Evidence record

  Source

  A chained entry that an auditor can verify and export.

Why it matters

Prevented, not just logged

In a runner you operate the call does not happen unless the gateway allows it.

Explainable

Every denial names the rule, so a developer knows what to change or whom to ask.