# Stop secrets leaking in model output

Arm an output-phase secrets guard — which of the three detectors to use, what each costs, and what the streaming caveat means here.

Source: https://tokentriage.com/docs/recipes/stop-secrets-leaking-in-model-output

---
An output binding inspects a bounded buffered response before it reaches the client. Begin in monitor mode with the ruleset detector, select the profile explicitly, then test detection and failure cases before enforcement.

```yaml
guardrails:
  enabled: true
  default_profile: standard
  local_budget_ms: 50
  guards:
    - id: sec_out
      category: secrets
      phases: [output]
      detectors: [secrets.ruleset]
      mode: monitor
      action: redact
      rule_ref: POL-SEC-1
  profiles:
    standard: [sec_out]
```

`default_profile: standard` makes this binding effective for requests without another profile assignment. Defining a guard and a profile alone does not select them.

| Detector | Scope |
|---|---|
| `secrets.ruleset` | Named provider patterns and structured credential forms |
| `secrets.generic` | Assignment-shaped credentials without a recognizable issuer |
| `secrets.entropy` | Suspicious high-entropy candidate strings |

Detector versions bind changes to their rules and scan behavior. Repository fixtures are synthetic regression cases; historical measurements from an earlier scanner version are not current precision, recall or latency guarantees. Evaluate the selected versions against representative positive and benign examples.

## Move from findings to enforced delivery

Change `mode` to `enforce` after checking the extracted surface, detector execution and proposed action. Choose `on_error` deliberately: `open` can release bytes when inspection fails; acknowledged `closed` suppresses unreleased output on protection failure. An oversize, opaque, malformed or timed-out response is not a clean result. Use [the failure matrix](/docs/guardrails/phases-and-streaming) and verify those cases with actual client bytes and stored receipts.

A successful redaction requires a complete committed transformation. The receipt should show both the mutation and what was delivered. No-finding rows without completed inspection establish no protection claim.

## Streaming needs its own policy

An `output` binding does not silently become an incremental stream guard. The secrets detectors have no incremental matcher. The stock gateway rejects `stream_fallback: buffer` during activation. For unavailable incremental coverage, `monitor` records the gap and applies the effective mode and failure posture; acknowledged `closed` suppresses unreleased bytes in enforcing mode. Monitor mode preserves traffic. See the [failure matrix](/docs/guardrails/phases-and-streaming).

Neither bounded non-streaming output inspection nor a larger local budget guarantees successful inspection for every response. Exhaustion applies the configured failure posture. When the requirement is to withhold a credential whenever protection cannot complete, verify the acknowledged closed path as well as the successful redaction path.

Credentials are not checked with their issuers; a revoked key can match just as a live key can. Tool schemas, metadata and media content remain outside this recipe's mutation scope. See [What gets inspected](/docs/guardrails/what-gets-inspected).