Skip to content

Plane 1: Context DLP & Token Sanitizer

The first plane of defense operates at the context ingress layer, inspecting text strings, prompt buffers, and agent candidate facts before they reach the model or tool executor.

Capabilities

1. Shannon Entropy Secret Detection

Randomness analysis identifies high-entropy strings characteristic of cryptographic credentials, API tokens, and private keys:

$$\mathcal{H}(X) = -\sum_{i=1}^{n} P(x_i) \log_2 P(x_i)$$

When a token or string segment exceeds $\mathcal{H} > 4.5$ without structured punctuation, it is flagged as a potential credential and redacted before transmission.

2. High-Precision Regex & PII Redaction

  • AWS Secret Access Keys: AKIA[0-9A-Z]{16}
  • SSH / RSA Private Keys: -----BEGIN [A-Z]+ PRIVATE KEY-----
  • Credit Card Numbers: Luhn algorithm checksum validation.
  • Social Security Numbers & PII: Regulated personally identifiable information.

3. 128k Pricing Cliff Guard & Token Compaction

Large language models apply steep cost increases when context windows exceed specific thresholds (e.g., 128k tokens).

Plane 1 dynamically detects approaching limits and compacts: - Stripping ANSI escape codes and terminal progress bars. - Compacting AST structures and whitespace. - Suppressing repetitive continuous log lines.