What Never Reaches the Model: Secrets and Personal Data
An engineer is debugging a failed payment job at the end of a long day. They copy the job's config into the chat to ask what's wrong. The config has a live database connection string in it, password included.
Nobody meant to share it. That's how it always happens. And a tool reading production output will print a token sooner or later, because that's what production output contains.
So we design for both directions. Secrets come in through what people paste, and they come out through what tools print. This post covers how Frontier Investigation Agents keep both away from the model, the screen and anyone you share a conversation with.
Why the usual approach breaks
The common answer is a policy: "don't paste secrets into AI tools". Policies don't survive a 2 a.m. incident. People paste what's in front of them.
The other common answer is a filter after the fact. Scan the logs, find the key, rotate it. By then the value is in a transcript, maybe in a model provider's request, maybe on a public link. Rotation is the cleanup, not the protection.
We wanted the check to happen before the value goes anywhere, and the default to be that the model works with a stand-in, never the real thing.
Four checkpoints
01On send
Scan the paste
Credential-shaped values stop the message until you decide.
02Model call
Swap for placeholders
Known secrets and detected personal identifiers go out as stand-ins.
03Agent output
Scrub what it shows
Known secret values are replaced in chat, stored output and logs.
04Public replay
Scan again
Detected secrets and personal data become REDACTED before a viewer sees them.
Each checkpoint covers a different leak. Together they cover the path a value takes from your keyboard to a page someone outside your team might read.
Checkpoint one: when you paste
When you send a message, CloudThinker scans it for credential-shaped values: API keys, tokens, passwords, connection strings. Long pasted text is scanned the same way before it's attached.
If something is detected, a Review detected secrets dialog opens and the message waits. Nothing is sent until you decide, item by item.
01Save secrets
Store and reference
The value becomes a workspace credential and the message uses $KEY.
02Redact
Remove and send
The value is replaced with [sensitive data removed].
03Not a secret
Keep as written
The item is treated as a false positive and sent unchanged.
Save secrets stores the value as a workspace credential and rewrites your message to reference $KEY instead. The agent can still use the secret in the commands it runs, and it sees the key name, not the value. Saving needs the Admin workspace role; everyone else can redact or mark a false positive.
That's the connection string from the opening scene. The engineer gets their answer about the config, and the password never lands in the transcript.
Checkpoint two: before the model call
A model call sends the agent's system prompt, tool definitions, conversation history and retrieved context. Before it goes out, CloudThinker replaces known secrets and detected personal identifiers with placeholders.
The placeholders look like this:
ct:secret:v2:…
ct:pii:v3:<category>:<hash>
A placeholder is irreversible. It can't be converted back to the value, by you or by an agent. But the same value gets the same placeholder within a conversation, so the agent can still tell that two references point at one secret. It can reason "this key in the error is the key in the config" without ever holding the key.
This holds on your own model key too. With BYOK, calls go to your AWS Bedrock or Anthropic account, and the same placeholders are applied first.
Checkpoint three: what agents show back
When an agent's work would surface a known secret value (a connection credential, a workspace credential, or a value you saved from chat) the value is replaced with the placeholder before it appears anywhere: in chat, in stored output, or in logs.
Agents see and report credential key names only. To change a secret, you update it in Connections or Credentials. There's no way to read it back out through the agent.
Checkpoint four: public replays
A conversation can be shared as a public replay. Before any viewer sees it, CloudThinker scans it again. Detected secrets and personal data in message text, tool activity, plans and attachment names are replaced with ***REDACTED***.
If a message can't be scanned cleanly, its content is withheld entirely. We'd rather show a gap than show something unscanned.
Your own identifiers: custom guardrails
Built-in protections cover the common formats. Your business has its own: account numbers, customer IDs, internal reference codes.
Admin Settings → Guardrails lets admins choose which built-in identifiers are protected and add custom patterns for structured personal or business identifiers. A pattern is a regular expression for the format, never a real value. ACC-\d{6} describes the prefix ACC- followed by six digits. When it matches, the agent sees a ct:pii: placeholder with the category you chose.
01Off
Does not run
A custom pattern stays saved and still uses one of five slots.
02Organization
Every workspace
Owners and Admins manage this baseline and can lock built-in rules.
03Workspace
This workspace
Where new custom patterns start, managed by workspace admins.
Each rule or pattern runs Off, at Workspace scope, or at Organization scope. An organization admin can lock a built-in rule so it stays on in every workspace. Before a pattern saves, Guardrails checks that it's valid, can't match empty text, and is fast enough to run on messages.
The design decisions
Check before send, not after. A secret caught in the dialog was never stored. A secret caught in a log scan already was.
Storing is always explicit. Nothing becomes a workspace credential without your confirmation.
Consistent stand-ins. An agent that can't tell two secrets apart can't debug a credential mismatch. Same value, same placeholder, inside one conversation.
Withhold on doubt. On a public page, an unscannable message is hidden, not shown.
Honest limits
Detection runs on send, not while you type. Unsent drafts stay in your browser for up to 24 hours and are cleared when you log out. On a shared computer, log out instead of closing the tab.
"Mark as not a secret" means what it says. If you mark a real key as a false positive, it goes through as written.
Output scrubbing covers known values. The placeholder applies to secrets CloudThinker holds (connections, credentials, values saved from chat) and to detected personal identifiers.
Custom patterns are for identifiers, not secrets. They extend identifier protection and don't add secret-detection rules. Each workspace gets five custom patterns, counting organization patterns that apply to it. There's no match preview, so test with care.
Broad patterns cost you context. A generic UUID pattern would mask values the agent needs to investigate. Make each pattern specific to your format.
Deleting a pattern is permanent. Agents may see matching values again if no other protection catches them.
Try it
"Here's the config for the failing job. Tell me why the connection keeps timing out." (paste it with the secret in, and watch the dialog)
"Use $STRIPE_API_KEY to list this week's failed payments and tell me which key you used, by name."
Start a trial or book a walkthrough.