Context
The leak surface has moved from "one prompt" to the whole agent loop: tool-call arguments, tool results, MCP payloads, memories, traces. 2026 agent-security reporting puts PII in 65% of shadow-AI incidents, and the guardrail kits (LLM Guard, NeMo Guardrails) scan text; almost nothing sanitizes structured tool traffic while guaranteeing the schema stays valid, which is exactly what an agent needs (a sanitized tool call must still validate against the tool's JSON schema and still execute).
Pseudonymize's typed-location architecture (JSON paths, per-path policies, structure-preserving processing) is already the right substrate. This proposal is an application of existing machinery, not a new layer.
Proposal
- A tool-call boundary: given a JSON tool call (name + arguments) and an optional JSON schema, pseudonymize string values while guaranteeing the output still validates: types, enums, formats and required fields untouched, only free-text and identifier-bearing string fields transformed under per-path policy.
- Bidirectional: sanitize arguments going out to a hosted model's tool-use loop, restore aliases in results coming back (pairs naturally with the round-trip session proposal).
- Per-path policy sugar for the common cases:
exclude_paths for fields the tool functionally needs raw (already exists), plus a "verbatim required by schema" rule derived automatically from enums/formats.
- Documentation for the three loops that matter in practice: OpenAI tool use, Anthropic tool use, MCP.
Why this wins
Gateways can regex a payload; they cannot promise the sanitized call still executes. A typed library sitting in-process can. This is the structural advantage of being a library rather than a proxy, and no competitor in the OSS space occupies it.
Fit
Core stays dependency-free (JSON schema validation can be a narrow optional extra or a minimal internal subset for the guarantees actually needed). Network-deny defaults unchanged.
🤖 Generated with Claude Code
https://claude.ai/code/session_012JiX3zWeEC28kmy5KmAXvf
Context
The leak surface has moved from "one prompt" to the whole agent loop: tool-call arguments, tool results, MCP payloads, memories, traces. 2026 agent-security reporting puts PII in 65% of shadow-AI incidents, and the guardrail kits (LLM Guard, NeMo Guardrails) scan text; almost nothing sanitizes structured tool traffic while guaranteeing the schema stays valid, which is exactly what an agent needs (a sanitized tool call must still validate against the tool's JSON schema and still execute).
Pseudonymize's typed-location architecture (JSON paths, per-path policies, structure-preserving processing) is already the right substrate. This proposal is an application of existing machinery, not a new layer.
Proposal
exclude_pathsfor fields the tool functionally needs raw (already exists), plus a "verbatim required by schema" rule derived automatically from enums/formats.Why this wins
Gateways can regex a payload; they cannot promise the sanitized call still executes. A typed library sitting in-process can. This is the structural advantage of being a library rather than a proxy, and no competitor in the OSS space occupies it.
Fit
Core stays dependency-free (JSON schema validation can be a narrow optional extra or a minimal internal subset for the guarantees actually needed). Network-deny defaults unchanged.
🤖 Generated with Claude Code
https://claude.ai/code/session_012JiX3zWeEC28kmy5KmAXvf