Command gating
Under enforcement, allowlists and blocked shell constructs restrict supported command execution. Review arguments and host permissions as well as the executable.
Explore this capabilitySecurity & Governance
Set the boundary.Control what crosses it.
LeanCTX is the Context Gateway for AI systems. It checks what AI agents read before the model sees it: project boundaries, secret redaction, warn, redact or block filters, and a delivery record.
The approach
Control access. Then check the content.
PathJail checks which files a request MAY read. Source permissions set which connected sources the caller may access; relevance rules help decide which permitted content SHOULD enter context. Enabled text filters inspect supported tool results before delivery. A delivery receipt records what the supported integration delivered, not how a model later used it.
ControlPathJail
Keep reads inside your boundaries.
PathJail validates the resolved file path against allowed roots. Traversal and symlinks must lead to a permitted destination.
- Allowed roots
- Project, configured extra roots and runtime exceptions define the effective scope.
- Resolved paths
- An out-of-scope symlink target is not made safe by an in-scope link.
- File boundary
- Keep reads within allowed directories. PathJail checks resolved paths, including symlinks and traversal attempts. It is an application-level check, not an OS sandbox, and cannot eliminate operating-system or race-condition limits.
ControlContent inspection
An allowed file still needs rules.
Useful code and sensitive customer fields can sit in the same permitted source. Inspect supported text results with configured detectors and patterns before delivery. Reading locally to inspect content is different from sending that content to a model.
- Personal data
- Detectors include email, IBAN, payment-card and Swiss AHV formats.
- Classification
- Rules inspect configured labels in the text.
- Injection patterns
- Pattern-based checks identify supported instructions embedded in source content.
ProveResponse & evidence
Warn. Redact. Block. With a record of each.
Choose how each detector responds. Filter metadata reports categories and counts without sensitive matched values; audit detail depends on the event path.
- Warn
- Return content with a warning.
- Redact
- Replace detected matches before delivery.
- Block
- Withhold the result and return a refusal.
/project/notes.txt Within allowed root
Content policy
contact: person@example.test
Returned text
contact: person@example.test
Warning: detected email
contact: [REDACTED:email]
[POLICY BLOCKED]
Content withheld
Example data. An active policy is required.
Organizational governance
Carry policy beyond the file.
The Enterprise offer adds organization-level identity, policy and reporting controls. The exact source, provider and action controls depend on the selected release and agreement; an optimizer may propose a route but cannot grant permission.
- Identity & access
- Use organization roles and workload identities where they are included in the licensed release.
- Provider & processing
- Confirm permitted destinations and processing controls for the selected release.
- Policy & reporting
- Review the reporting and retained evidence included in the release and agreement.
In your workflow
Different risks. Deliberate controls.
A file boundary is one layer. Commands, credentials, network destinations and project configuration need their own decisions.
Credential safeguards
Secret detection and redaction have their own configuration. They complement PII and classification filters; none replaces a review of what your integration actually returns.
Explore this capabilityWorkspace trust
Project configuration can request sensitive overrides. Review and trust that configuration explicitly before accepting broader behavior.
Explore this capabilityNetwork & processing boundaries
Validate supported network destinations and apply the deployment’s provider and processing policy. Direct calls outside that path require their own controls.
Explore this capabilityQuestions & answers
Security questions.
Does this replace application security?
No. Enable the required filters and verify the actual integration path. Images, binary data and calls outside LeanCTX need their own controls. Keep host permissions and application safeguards in place.
Are all filters enabled automatically?
No. The content-filter configuration defaults to off. Enable the required actions in your active policy and verify the supported result path. PathJail and other redaction controls have their own configuration.
Does this guarantee that no sensitive content reaches a model?
No detector recognises every threat or sensitive value. The controls apply to supported calls, formats and enabled rules. Test them as part of your complete application security model.
Start with LeanCTX
Test your context rules.
Define your allowed sources, enable the relevant checks and verify a supported read against your policy.
Local-first. Model-agnostic. Your context.