What a tool-call guard keeps about people: a marker census of its own stores
After minimisation, the proxy's and the gateway's intent records no longer held withheld values declared sensitive, and their logs held no provider refusal text; the census found 3 leak paths code reading had missed.
Prediction heldWhere does it stop?Re-checked
- Designed for
- To find which of the guard's own stores keep provider data, agent arguments, refusal text or digests, and whether the planned minimisation steps remove what they were meant to remove.
What was tested
Deterministic tests. A fake service answered with marked values (shown to the agent, withheld, refusal text), and the agent passed marked arguments. The proxy scenario included a cross-anchor cancel refused by the ownership rule; the gateway added a form body. A scanner read every store, decoded encodings and recomputed digests.
What we observed
Before, proxy intent records held withheld values, and the log and standard error held refusal text. After, proxy intent records held only shown values and digests, and its log and standard error held no markers; gateway intent records lost withheld values, and its log held no markers. The census found 3 paths code reading had missed: the log copied to standard error, a whole error object in the gateway log, and a request digest in the operator journal.
What this means for Heimdall
A pinned census turns a storage rule into a failing test. Its result bears on what the delegate keeps.
Limits
Synthetic markers, one scenario per entry point. Only declared sensitive keys are removed, and shipped declarations mostly take answers whole. The witness keeps everything by default. Database stores and latency were not measured.
What remains open
Extend the census to database stores and measure latency.