Sensitive data audit

Case note

I needed a way to locate sensitive data without putting the protected values back into reports or agent context. The pipeline was built by AI agents, and rather than instruct them not to read the protected data, I constructed the workspace so they can’t. Independent layers (context exclusions, a pre-tool-call hook, per-agent tool restrictions, and related denies) each deny access on their own, while the runtime code reads those paths freely.

Figure 1 — Scan to report

The first figure follows a scan from S3 buckets to a report.

1. 01
   S3 buckets

   across accountsread-only scan
2. 02
   Extract text

   PDF · DOCX · XLSXper file
3. 03
   Match

   pattern matchingroster-derived vocabulary
4. 04
   Entity detection

   managed AI servicesecond detection layer
5. 05
   Combo rulesGate

   suppress false positives
6. 06
   Report

   CSV + JSONLcounts, never values

Two independent detection layers reduce false positives before anything is written to the report.

Figure 2 — Pre-tool hook denies protected paths

The second shows the guardrail hook that lets runtime code read protected data while denying the build agent that same access.

1. 1
   Agent tool call
2. 2
   Normalize path
3. 3
   Match protected pathsGate
4. 4
   Deny or allowGate
5. 5
   Runtime reads freely

   same paths, different actor

Every agent tool call is inspected. Protected-path matches are denied; everything else falls through to allow.

Zones

Build zone

The pipeline was built by AI agents that never had read access to the protected data themselves.

Guardrail zone

Five independent layers, including a pre-tool-call hook, each deny access to protected paths on their own.

Detection zone

Deterministic pattern matching and managed entity detection run as two independent layers.

Report zone

Output names files, columns, and match counts. The values themselves never leave the scan.

Cross-references

Detection is layered too: deterministic pattern matching plus managed entity detection. Publish Guardian is the publication-side cousin for secret leakage. Edit/merge separation keeps discovery reports from becoming unreviewed production change. Scans are batch-oriented and evidence-first: findings cite paths and patterns so remediation can be ticketed without guesswork.

Toolchain