Any scanner catches a key. Almost none catches your code.
A coding agent sends source to a model on every prompt, and it chooses what to send. Writing the policy takes a minute: proprietary source does not go to an external model. Knowing that this block of text is yours is the hard part.
Rules plus an index built from your repositories.
Why a normal DLP tool cannot do it
| Sent by the agent | Secret scanner | Fingerprinting |
|---|---|---|
| An API key | catches it | - |
| A public library's source | ignores it | ignores it, correctly |
| Your pricing engine, verbatim | ignores it | catches it |
| Your pricing engine, renamed and reformatted | ignores it | catches it |
The last row is the whole problem: what the agent sends is never quite what is committed, so string matching against a repository finds nothing.
Where each level of secrecy may go
signals:
code_fp:
udf: dlp/code_fingerprint
rules:
secrecy_top_requires_level_100:
condition: >
signals.code_fp.by_category["secrecy-top"].probability >= 0.5
effects:
response:
required_risk_level: 100
secrecy_medium_requires_level_50:
condition: >
signals.code_fp.by_category["secrecy-medium"].probability >= 0.5
effects:
response:
required_risk_level: 50 A rule states a requirement instead of refusing. Top-secrecy code may only reach a provider you run yourself. The middle tier may go to a vendor you hold a contract with. Anything the table does not name goes wherever the endpoint would have sent it. The gateway takes the strictest level required by the matched rules and by the calling agent, then routes to a provider that meets it, or refuses when none does.
What it protects, in practice
The narrow set of organizations where source code is the company: quantitative trading, chip design, defense and aerospace, robotics, game engines. For everyone else this is a nice-to-have. For them it is the reason the coding agent is banned outright today, which costs the business more than governing it would.
Kept separate from redaction on purpose
Personal data and secrets are matched. Proprietary code is recognized. See data redaction.