Command gating
Under enforcement, allowlists and blocked shell constructs restrict supported command execution. Review arguments and host permissions as well as the executable.
Explore this capabilitySecurity & Governance
Set the boundary.Control what crosses it.
A file can be accessible and still contain information your model should not receive. LeanCTX separates source access from content checks on supported tool results.
The approach
Control access. Then check the content.
PathJail checks where a file read is allowed. Enabled text filters check what supported results may contain before delivery.
PathJail
Keep reads inside your boundaries.
PathJail validates the resolved file path against allowed roots. Traversal and symlinks must lead to a permitted destination.
- Allowed roots
- Project, configured extra roots and runtime exceptions define the effective scope.
- Resolved paths
- An out-of-scope symlink target is not made safe by an in-scope link.
- File boundary
- This check controls supported file access; it is not an operating-system sandbox.
Content inspection
An allowed file still needs rules.
Useful code and sensitive customer fields can sit in the same permitted source. Inspect supported text results with configured detectors and patterns before delivery. Reading locally to inspect content is different from sending that content to a model.
- Personal data
- Detectors include email, IBAN, payment-card and Swiss AHV formats.
- Classification
- Rules inspect configured labels in the text.
- Injection patterns
- Pattern-based checks identify supported instructions embedded in source content.
Response & evidence
Warn. Redact. Block.
Choose how each detector responds. Filter metadata reports categories and counts without sensitive matched values; audit detail depends on the event path.
- Warn
- Return content with a warning.
- Redact
- Replace detected matches before delivery.
- Block
- Withhold the result and return a refusal.
/project/notes.txt Within allowed root
Content policy
contact: person@example.test
Returned text
contact: person@example.test
Warning: detected email
contact: [REDACTED:email]
[POLICY BLOCKED]
Content withheld
Example data. An active policy is required.
Organizational governance
Carry policy beyond the file.
Enterprise governance adds organization-level identity, source, provider and action policies. Apply them at the supported access and execution boundaries; an optimizer may propose a route but cannot grant permission.
- Identity & access
- Bind source and action access to organization roles and workload identities, with provisioning and revocation in the Enterprise identity lifecycle.
- Provider & processing
- Apply permitted destinations, classification and processing-location requirements at the governed request boundary.
- Policy & audit
- Keep organization budgets, policy revisions and retained decision evidence traceable to the governed request.
In your workflow
Different risks. Deliberate controls.
A file boundary is one layer. Commands, credentials, network destinations and project configuration need their own decisions.
Credential safeguards
Secret detection and redaction have their own configuration. They complement PII and classification filters; none replaces a review of what your integration actually returns.
Explore this capabilityWorkspace trust
Project configuration can request sensitive overrides. Review and trust that configuration explicitly before accepting broader behavior.
Explore this capabilityNetwork & processing boundaries
Validate supported network destinations and apply the deployment’s provider and processing policy. Direct calls outside that path require their own controls.
Explore this capabilityQuestions & answers
Security questions.
Does this replace application security?
No. Enable the required filters and verify the actual integration path. Images, binary data and calls outside LeanCTX need their own controls. Keep host permissions and application safeguards in place.
Are all filters enabled automatically?
No. The content-filter configuration defaults to off. Enable the required actions in your active policy and verify the supported result path. PathJail and other redaction controls have their own configuration.
Does this guarantee that no sensitive content reaches a model?
No detector recognises every threat or sensitive value. The controls apply to supported calls, formats and enabled rules. Test them as part of your complete application security model.
Start with LeanCTX
Test your context rules.
Define your allowed sources, enable the relevant checks and verify a supported read against your policy.
Local-first. Model-agnostic. Your context.